supply-chain-risk-auditor: Measuring Dependency Supply Chain Risk with Scripts
supply-chain-risk-auditor is an Agent Skill in the Trail of Bits skills marketplace that generates supply-chain risk reports for npm, PyPI, and Go project manifests and lock files. Using collect.py and render.py, it gathers metrics such as version-matched advisories, transitive dependencies, upstream archives, npm publisher concentration, and install scripts, while the Agent handles prioritization and upgrade recommendations. The article explains installation, workflow, the effects of gh authentication, and applicable limitations, emphasizing how to interpret unassessable entries and coverage tables, and cautions against replacing script-based measurements with manual estimates.
Read MoreTesting Handbook Skills: Turning the Testing Handbook into an Executable AppSec Testing Workflow
testing-handbook-skills is a Code Auditing plugin in the Trail of Bits skills marketplace that structures the Testing Handbook on appsec.guide into a Skill usable by Claude Code or Codex. It includes the testing-handbook-generator meta-skill, 14 generated fuzzer, technology, and domain topics, and validation support via validate-skills.py. The article explains its positioning, generation workflow, installation commands for Claude Code and Codex, typical generation prompts, usage of uv-based validation, and considerations such as manual resolution of handbook paths, the absence of generated cross-references, and the need to provide the required tool environment yourself.
Read Moremutation-testing: Running a mewt/muton Mutation Testing Campaign with an Agent Skill
mutation-testing is a Verification-class skill in the Trail of Bits Skills marketplace, designed to help configure mewt or muton mutation-testing campaigns with AI assistance, analyze surviving mutants, and trace test gaps back to source-code issues. The skill routes workflows such as configuration acceleration, bug hunting, and result analysis/reporting based on the scenario, and defines the meanings of outcome statuses such as Uncaught and Timeout, along with common CLI usage. The article explains how to add the trailofbits/skills marketplace to Claude Code/Codex and covers typical commands such as init, run, results, and test, making it suitable for teams that already use or plan to use mutation testing.
Read Morerust-review: A Security Review Skill for Rust Codebases
rust-review is a Rust code security review Skill in the Trail of Bits skills marketplace. It uses an orchestrator with worker, dedup, and fp subagents to cover safe/unsafe boundaries, unsafe memory safety, concurrency, panic-DoS, FFI, and async runtime issues, producing REPORT.md and REPORT.sarif. It is suitable for auditing crates and services that include unsafe code, FFI, or concurrency; for scenarios such as pure C/C++, smart contracts, and key zeroing, use c-review, contract-specific Skills, or zeroize-audit instead. After adding the trailofbits/skills marketplace in Claude Code or Codex, start the review with /rust-review:rust-review.
Read Moreagentic-actions-auditor: Auditing Security Risks in AI Agent Integrations for GitHub Actions
agentic-actions-auditor is a Skill in the Trail of Bits skills marketplace for statically auditing GitHub Actions workflows that invoke Claude Code Action, OpenAI Codex, Gemini CLI, or GitHub AI Inference. It guides an Agent to discover workflows, identify AI steps, trace composite/reusable references, and detect vectors such as environment variable relay, expression injection, unsafe sandboxing, and wildcard user allowlists. It supports local Glob scanning and fetching remote repositories via the gh api. It is intended for security review before an Agent is integrated into CI, and does not perform runtime exploitation or automatic file modification.
Read Moreskill-improver: Polish SKILL.md to Publishable Quality with a Fix-Review Loop
skill-improver is a meta-skill in the Trail of Bits skills marketplace. It depends on skill-reviewer from plugin-dev and runs iterative review-and-repair cycles on a target SKILL.md, remediating issues by Critical, Major, or Minor severity and re-reviewing them until it emits skill-improvement-complete or reaches the default limit of 20 iterations. It is well suited to batch-aligning frontmatter, trigger descriptions, and When to Use structure; for a single review, use skill-reviewer directly. To install it, first add the trailofbits/skills marketplace and enable plugin-dev, then start the loop in Claude Code by running /skill-improver with the target path.
Read Moresecond-opinion: External Code Review of Git Changes with Codex or Antigravity
second-opinion is an Agent Skill in the Trail of Bits skills marketplace. It invokes Codex, Antigravity, or Gemini CLI to perform independent code reviews and consolidate findings for uncommitted changes, branch diffs, or specified commits, supporting side-by-side comparison of two providers on the same patch. It does not automatically modify code or post to a remote. The article explains the review scope and focus, diff and temporary-file conventions, CLI invocation methods, and marketplace installation commands and official slash-command examples for Claude Code and Codex.
Read MoreAudit Context Building: Build the Audit Context Before Vulnerability Hunting
Trail of Bits' audit-context-building Skill begins the audit and threat modeling process by documenting assumptions, guarantees, and dependencies on a per-function basis. It generates a DOSSIER and function-level records, marking “nothing found” results and open questions, and does not name vulnerabilities. It is compatible with Claude Code, Codex, and similar tools, and can be installed via the trailofbits/skills marketplace.
Read MoreSharp Edges: Finding Security Footguns in APIs Through a Design-Review Lens
sharp-edges is an Agent Skill provided by Trail of Bits for evaluating whether APIs, configurations, and interfaces are resistant to developer misuse. It focuses on six categories of footguns, including algorithm selection, dangerous defaults, configuration cliffs, and silent failures, and follows the principle of pit of success. It provides sharp-edges-analyzer and a four-stage analysis workflow. Install it with: `npx skills add https://github.com/trailofbits/skills --skill sharp-edges`. It is suitable for API/configuration design reviews, but does not replace audits of implementation bugs or business logic.
Read MoreVariant Analysis: Locate a Bug and Eliminate All Similar Ones
Trail of Bits’ variant-analysis has turned the daily variant analysis work of security engineers into an Agent Skill: after confirming a vulnerability, it extracts the root cause, calibrates with precise patterns, searches the entire codebase while relaxing only one condition at a time, and finally triages and leaves CI rules. This article explains the five-step workflow, the selection of ripgrep, Semgrep and CodeQL, as well as the installation and invocation methods of Claude Code, Codex and Cursor, based on the official SKILL.md, plugin README and policy documents.
Read MoreSemgrep-Rule-Creator: Using Agent to Write Testable Semgrep Security Rules
`semgrep-rule-creator` is an Agent Skill launched by Trail of Bits, used to create custom Semgrep rules that can detect security vulnerabilities, bug patterns and code patterns. Instead of running existing rule sets, it forces the Agent to produce rules following the workflow of test-first, AST analysis, priority given to taint mode, and optimization only after all tests pass. This article organizes the installation method, seven-step workflow, eval taint example and usage boundaries based on the official SKILL.md, plugin README and skill market description.
Read More# Property-Based Testing: Trail of Bits Turns Property Testing into Reusable Agent Skills
Trail of Bits' property-based-testing is a cross-language skill guide for property testing that includes smart contracts. It teaches agents to identify encoding/decoding, parsing, normalization, and contract invariants, write tests based on properties like round-trip and idempotence, and distinguish between test errors and real bugs when tests fail. Based on the official SKILL.md, plugin READMEs and market repositories, the article explains the installation of Claude Code / Codex, the `npx skills add` command, and reproducible examples such as Hypothesis.
Read MoreDifferential Review: Trail of Bits formalizes PR security differential review into an executable workflow
Differential-review is an Agent Skill released by Trail of Bits, which conducts security-focused reviews on PRs, commits and diffs: it classifies tasks by risk rather than line count, uses git history to detect regressions, quantitatively calculates the blast radius, treats missing tests as a higher risk factor, and enforces the output of a Markdown report with line numbers and attack scenarios. This article checks the official SKILL.md, plugin README and documentation website, explaining what problems it solves, how to install it in Claude Code / Codex / the general Skill catalog, as well as three official usage scenarios and inapplicable scenarios.
Read More