# Trail of Bits Skills

> A plugin marketplace from security firm Trail of Bits for Claude Code and Codex. Audit plugins cover CodeQL, Semgrep and SARIF static analysis, C/C++ and Rust security reviews, differential and insecure-defaults reviews, false-positive checks and a supply-chain auditor for npm, PyPI and Go; others cover smart contracts, fuzzing and constant-time crypto. CC-BY-SA-4.0, a share-alike licence rather than an OSI software licence. Needs a coding agent and its model; no hosted dashboard or continuous monitoring.

- Repository: https://github.com/trailofbits/skills
- Official docs: https://github.com/trailofbits/skills#readme
- Checked: 2026-10-26

## What it replaces
- Snyk: Find vulnerabilities in your own source code (SAST), Find vulnerable open-source dependencies (SCA) (partial). Agent-run CodeQL/Semgrep static analysis, language-specific security reviews and a supply-chain auditor for npm, PyPI and Go; no IaC or container scanning, no continuous monitoring or dashboard.
  - Use it instead of paying for Snyk? Personal use: Yes. Business: Partly (Commercial use with conditions: Yes, with attribution, and adapted versions must stay CC-BY-SA).

## Facts, with sources

| Question | Status | Answer | Source | Checked |
|---|---|---|---|---|
| Runs on my machine? | Confirmed | Yes, plugins installed into your local Claude Code or Codex | https://github.com/trailofbits/skills#installation | 2026-10-23 |
| Code licence | Partial | CC-BY-SA-4.0, a Creative Commons share-alike licence rather than an OSI software licence | https://github.com/trailofbits/skills#license | 2026-10-23 |
| Model weights licence | Confirmed | No bundled weights; depends on the model your coding agent uses | https://github.com/trailofbits/skills#installation | 2026-10-23 |
| Commercial use | Partial | Yes, with attribution, and adapted versions must stay CC-BY-SA | https://creativecommons.org/licenses/by-sa/4.0/ | 2026-10-23 |
| Paid services needed? | Partial | Needs Claude Code, Codex or a ChatGPT workspace, which usually means a paid plan or API key | https://github.com/trailofbits/skills#installation | 2026-10-23 |
| Hardware | Confirmed | No hardware needs of its own; runs wherever the host agent runs; some plugins call external tools such as CodeQL, Semgrep or apktool | https://github.com/trailofbits/skills#installation | 2026-10-26 |
| Operating systems | Partial | Runs wherever Claude Code or Codex runs; plugin prerequisites are documented for macOS (Homebrew) and Ubuntu/Debian (apt), with no Windows instructions | https://github.com/trailofbits/skills/blob/main/plugins/firebase-apk-scanner/README.md#prerequisites | 2026-10-26 |
| Setup effort | Confirmed | Easy, one /plugin marketplace add command, then pick plugins from /plugin menu | https://github.com/trailofbits/skills#claude-code-marketplace | 2026-10-23 |

GitHub: 7965 stars, 678 forks, last push 2026-11-02, archived: no.

## Alternatives to Trail of Bits Skills
- [Cloudflare Security Audit Skill](https://repoquarry.dev/projects/security-audit-skill.md): Cloudflare's coding-agent skill that runs a six-phase security audit of a codebase, with every finding re-checked by a separate agent.
- [Defending Code Reference Harness](https://repoquarry.dev/projects/defending-code-reference-harness.md): Anthropic's reference Claude Code skills and autonomous pipeline for threat modelling, vulnerability scanning, triage and patching. Not maintained.
- [Superpowers](https://repoquarry.dev/projects/superpowers.md): Skill library for coding agents that walks them through brainstorming, planning, test-driven development, subagent work and code review.
- [Skills For Real Engineers (Matt Pocock)](https://repoquarry.dev/projects/mattpocock-skills.md): Matt Pocock's small, composable agent skills for engineering work, such as grilling sessions, TDD, bug diagnosis, specs and code review.
- [ECC](https://repoquarry.dev/projects/ecc.md): Large plugin of agents, skills, hooks, rules and memory for Claude Code, with native Codex and Qoder plugins and partial adapters for other agents.
- [Ponytail](https://repoquarry.dev/projects/ponytail.md): A skill (one prompt) for AI coding agents that makes them reuse what exists and write less code, plus /ponytail-review and /ponytail-audit commands.
---
Source: RepoQuarry (https://repoquarry.dev/projects/trailofbits-skills). Data licence: CC BY 4.0. Quotes are from project documentation and belong to their authors.