{"version":"v1","licence":"CC-BY-4.0","id":"trailofbits-skills","name":"Trail of Bits Skills","repo":"trailofbits/skills","repository_url":"https://github.com/trailofbits/skills","docs_url":"https://github.com/trailofbits/skills#readme","description":"Trail of Bits' marketplace of 40+ security plugins for Claude Code and Codex, from CodeQL and Semgrep scans to C, Rust and supply-chain audits.","summary":"A plugin marketplace from security firm Trail of Bits for Claude Code and Codex. Audit plugins cover CodeQL, Semgrep and SARIF static analysis, C/C++ and Rust security reviews, differential and insecure-defaults reviews, false-positive checks and a supply-chain auditor for npm, PyPI and Go; others cover smart contracts, fuzzing and constant-time crypto. CC-BY-SA-4.0, a share-alike licence rather than an OSI software licence. Needs a coding agent and its model; no hosted dashboard or continuous monitoring.","capabilities":["agent-skills","code-scan","dependency-scan"],"tags":["Agent skills","Security"],"alternatives":[{"product":"snyk","jobs":["code-scan","dependency-scan"],"coverage":"partial","note":"Agent-run CodeQL/Semgrep static analysis, language-specific security reviews and a supply-chain auditor for npm, PyPI and Go; no IaC or container scanning, no continuous monitoring or dashboard."}],"facts":{"runs_locally":{"status":"yes","value":"Yes, plugins installed into your local Claude Code or Codex","source_url":"https://github.com/trailofbits/skills#installation","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","modes":["local"],"untrusted_source_quote":"Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace."},"code_license":{"status":"partial","value":"CC-BY-SA-4.0, a Creative Commons share-alike licence rather than an OSI software licence","source_url":"https://github.com/trailofbits/skills#license","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","spdx":"CC-BY-SA-4.0","untrusted_source_quote":"This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License"},"model_license":{"status":"yes","value":"No bundled weights; depends on the model your coding agent uses","source_url":"https://github.com/trailofbits/skills#installation","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","spdx":null,"applies":false},"commercial_use":{"status":"partial","value":"Yes, with attribution, and adapted versions must stay CC-BY-SA","source_url":"https://creativecommons.org/licenses/by-sa/4.0/","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","untrusted_source_quote":"for any purpose, even commercially"},"paid_services":{"status":"partial","value":"Needs Claude Code, Codex or a ChatGPT workspace, which usually means a paid plan or API key","source_url":"https://github.com/trailofbits/skills#installation","checked_at":"2026-10-23","confidence":"medium","validation":"documentation_review","required":[],"optional":["Claude Code","Codex","ChatGPT workspace"],"untrusted_source_quote":"Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace."},"hardware":{"status":"yes","value":"No hardware needs of its own; runs wherever the host agent runs; some plugins call external tools such as CodeQL, Semgrep or apktool","source_url":"https://github.com/trailofbits/skills#installation","checked_at":"2026-10-26","confidence":"medium","validation":"documentation_review","cpu_ok":true,"min_vram_gb":null,"min_ram_gb":null,"untrusted_source_quote":"Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace."},"platforms":{"status":"partial","value":"Runs wherever Claude Code or Codex runs; plugin prerequisites are documented for macOS (Homebrew) and Ubuntu/Debian (apt), with no Windows instructions","source_url":"https://github.com/trailofbits/skills/blob/main/plugins/firebase-apk-scanner/README.md#prerequisites","checked_at":"2026-10-26","confidence":"medium","validation":"documentation_review","windows":"unknown","macos":"yes","linux":"yes","untrusted_source_quote":"brew install apktool curl jq binutils"},"setup":{"status":"yes","value":"Easy, one /plugin marketplace add command, then pick plugins from /plugin menu","source_url":"https://github.com/trailofbits/skills#claude-code-marketplace","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","level":"easy","untrusted_source_quote":"/plugin marketplace add trailofbits/skills"}},"metrics":{"stars":7965,"forks":678,"contributors":65,"archived":false,"last_push_at":"2026-11-02T20:47:34Z","latest_release":null,"fetched_at":"2026-11-03T01:20:55.050Z"},"url":"https://repoquarry.dev/projects/trailofbits-skills","note":"Installation guidance: follow docs_url. This service never installs or runs code."}