Skill：skills
Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
适用场景
招聘人事
适合角色
介绍
以下内容整理自开源仓库 `trailofbits/skills` 的 README / SKILL.md 摘要： # Trail of Bits Skills Marketplace A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility. > Also see: [claude-code-config](https://github.com/trailofbits/claude-code-config) · [skills-curated](https://github.com/trailofbits/skills-curated) · [claude-code-devcontainer](https://github.com/trailofbits/claude-code-devcontainer) · [dropkit](https://github.com/trailofbits/dropkit) ## Installation ### Claude Code Marketplace ``` /plugin marketplace add trailofbits/skills ``` ### Browse and Install Plugins ``` /plugin menu ``` ### Codex Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata. Install the marketplace with: ```sh codex plugin marketplace add trailofbits/skills codex plugin list codex plugin add <plugin-name>@trailofbits ``` ### Local Development To add the marketplace locally (e.g., for testing or development), navigate to the **parent directory** of this repository: ``` cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects /plugins marketplace add ./skills ``` ## Available Plugins ### Smart Contract Security | Plugin | Description | |--------|-------------| | [building-secure-contracts](plugins/building-secure-contracts/) | Smart contract security toolkit with vulnerability scanners for 6 blockchains | | [entry-point-analyzer](plugins/entry-point-analyzer/) | Identify state-changing entry points in smart contracts for security auditing | ### Code Auditing | Plugin | Description | |--------|-------------| | [agentic-actions-auditor](plugins/agentic-actions-auditor/) | Audit GitHub Actions workflows for AI agent security vulnerabilities | | [audit-context-building](plugins/audit-context-building/) | Understand a codebase before looking for bugs in it, one function at a time | | [burpsuite-project-parser](plugins/burpsuite-project-parser/) | Search and extract data from Burp Suite project files | | [c-review](plugins/c-review/) | Comprehensive C/C++ security review with clustered parallel workers and SARIF output | | [differential-review](plugins/differential-review/) | Security-focused differential review of code changes with git history analysis | | [dimensional-analysis](plugins/dimensional-analysis/) | Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs | | [fp-check](plugins/fp-check/) | Systematic false positive verification for security bug analysis with mandatory gate reviews | | [insecure-defaults](plugins/insecure-defaults/) | Parallel audit workflow for fail-open insecure defaults, with a refuting verifier per candidate f ---
安装方式
1. 打开仓库：https://github.com/trailofbits/skills 2. 查找 SKILL.md 或 README 中的安装章节 3. 克隆或下载所需 Skill 子目录到本地 skills 路径（如 `.cursor/skills/` 或 `.claude/skills/`） 4. 重启 / 重载 Agent 客户端 5. 用一条真实任务验证 Skill 是否被正确加载
适用平台
- Claude
- Codex