Trail of Bits Skills
Trail of Bits' marketplace of 40+ security plugins for Claude Code and Codex, from CodeQL and Semgrep scans to C, Rust and supply-chain audits.
A plugin marketplace from security firm Trail of Bits for Claude Code and Codex. Audit plugins cover CodeQL, Semgrep and SARIF static analysis, C/C++ and Rust security reviews, differential and insecure-defaults reviews, false-positive checks and a supply-chain auditor for npm, PyPI and Go; others cover smart contracts, fuzzing and constant-time crypto. CC-BY-SA-4.0, a share-alike licence rather than an OSI software licence. Needs a coding agent and its model; no hosted dashboard or continuous monitoring.
The facts
| Question | Answer | Source | Checked |
|---|---|---|---|
| Runs on my machine? | Yes. Yes, plugins installed into your local Claude Code or Codex | github.com | Checked 11 days ago |
| Code licence | With conditions. CC-BY-SA-4.0, a Creative Commons share-alike licence rather than an OSI software licence | github.com | Checked 11 days ago |
| Commercial use | With conditions. Yes, with attribution, and adapted versions must stay CC-BY-SA | creativecommons.org | Checked 11 days ago |
| Paid services needed? | Optional. Needs Claude Code, Codex or a ChatGPT workspace, which usually means a paid plan or API key | github.com | Checked 11 days ago |
| Hardware | No hardware needs of its own; runs wherever the host agent runs; some plugins call external tools such as CodeQL, Semgrep or apktool | github.com | Checked 8 days ago |
| Operating systems | Runs wherever Claude Code or Codex runs; plugin prerequisites are documented for macOS (Homebrew) and Ubuntu/Debian (apt), with no Windows instructions | github.com | Checked 8 days ago |
| Setup effort | Easy, one /plugin marketplace add command, then pick plugins from /plugin menu | github.com | Checked 11 days ago |
Each fact has its own date. Unknown means nobody has published it. We read their documentation; we didn’t install it. Running it yourself costs your hardware, electricity and setup time. Report a correction.
No licence changes since we started watching. Licence changes: follow Trail of Bits Skills and we email you if its terms change.
What it replaces, job by job
| Paid tool | Jobs | How far it goes |
|---|---|---|
| Snyk $25/month |
| 2 of 3 jobs. Agent-run CodeQL/Semgrep static analysis, language-specific security reviews and a supply-chain auditor for npm, PyPI and Go; no IaC or container scanning, no continuous monitoring or dashboard. |
Stars over time
Building history +141 this week; not enough baseline history. Stars show attention, not quality. Where these numbers come from.