workflow-skill-design

Trail of Bits Skills Marketplace

A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows.

Also see: claude-code-config · skills-curated · claude-code-devcontainer · dropkit

Installation

Add the Marketplace

/plugin marketplace add trailofbits/skills

Browse and Install Plugins

/plugin menu

Local Development

To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:

cd /path/to/parent  # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills

Available Plugins

Smart Contract Security

Plugin	Description
building-secure-contracts	Smart contract security toolkit with vulnerability scanners for 6 blockchains
entry-point-analyzer	Identify state-changing entry points in smart contracts for security auditing

Code Auditing

Plugin	Description
audit-context-building	Build deep architectural context through ultra-granular code analysis
burpsuite-project-parser	Search and extract data from Burp Suite project files
differential-review	Security-focused differential review of code changes with git history analysis
insecure-defaults	Detect insecure default configurations, hardcoded credentials, and fail-open security patterns
semgrep-rule-creator	Create and refine Semgrep rules for custom vulnerability detection
semgrep-rule-variant-creator	Port existing Semgrep rules to new target languages with test-driven validation
sharp-edges	Identify error-prone APIs, dangerous configurations, and footgun designs
static-analysis	Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing
testing-handbook-skills	Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage
variant-analysis	Find similar vulnerabilities across codebases using pattern-based analysis

Malware Analysis

Plugin	Description
yara-authoring	YARA detection rule authoring with linting, atom analysis, and best practices

Verification

Plugin	Description
constant-time-analysis	Detect compiler-induced timing side-channels in cryptographic code
property-based-testing	Property-based testing guidance for multiple languages and smart contracts
spec-to-code-compliance	Specification-to-code compliance checker for blockchain audits

Reverse Engineering

Plugin	Description
dwarf-expert	Interact with and understand the DWARF debugging format

Mobile Security

Plugin	Description
firebase-apk-scanner	Scan Android APKs for Firebase security misconfigurations

Development

Plugin	Description
ask-questions-if-underspecified	Clarify requirements before implementing
devcontainer-setup	Create pre-configured devcontainers with Claude Code and language-specific tooling
gh-cli	Intercept GitHub URL fetches and redirect to the authenticated `gh` CLI
git-cleanup	Safely clean up git worktrees and local branches with gated confirmation workflow
modern-python	Modern Python tooling and best practices with uv, ruff, and pytest
second-opinion	Run code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on changes, diffs, or commits. Bundles codex-mcp-server.
workflow-skill-design	Design patterns for workflow-based Claude Code skills with review agent

Team Management

Plugin	Description
culture-index	Interpret Culture Index survey results for individuals and teams

Popularity

What's Inside

README

Trail of Bits Skills Marketplace

Installation

Add the Marketplace

Browse and Install Plugins

Local Development

Available Plugins

Smart Contract Security

Code Auditing

Malware Analysis

Verification

Reverse Engineering

Mobile Security

Development

Team Management

Tooling

Confidence

Similar Plugins

supergraph

octo

claude-code-harness

compound-engineering

More by p-11

debug-buttercup

constant-time-analysis

insecure-defaults

audit-context-building

seatbelt-sandboxer

Popularity

Health & Quality

More by p-11

debug-buttercup

constant-time-analysis

insecure-defaults

audit-context-building

seatbelt-sandboxer

Similar Plugins

supergraph

octo

claude-code-harness

compound-engineering