How do I install the Trailofbits Security skill?

Run npx skillmds@latest add plurigrid/trailofbits-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Trailofbits Security skill do?

- `codeql` - GitHub's semantic code analysis It is listed under Security on SkillMD.

Is Trailofbits Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Trailofbits Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Trailofbits Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Trailofbits Security?

plurigrid (@plurigrid) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Trailofbits Security by plurigrid — Agent Skill

Name: Trailofbits Security
Author: plurigrid

File contents

Trail of Bits Security Bundle

Provenance: Trail of Bits security research GF(3) Trit: -1 (MINUS) - Validation/Verification Mutual Awareness: k-dense-ai bundle (PLUS +1)

Skills (43)

Static Analysis

codeql - GitHub's semantic code analysis
semgrep - Fast pattern matching
semgrep-rule-creator - Custom rule authoring
sarif-parsing - SARIF report processing

Fuzzing

aflpp - AFL++ coverage-guided fuzzing
libfuzzer - In-process fuzzing
libafl - LibAFL framework
cargo-fuzz - Rust fuzzing
atheris - Python fuzzing
ruzzy - Ruby fuzzing
ossfuzz - Google OSS-Fuzz integration
harness-writing - Fuzzing harness design
fuzzing-dictionary - Dictionary optimization
fuzzing-obstacles - Overcoming blockers

Memory Safety

address-sanitizer - ASan for C/C++
constant-time-analysis - Timing side-channels
constant-time-testing - CT verification

Smart Contract Security

solana-vulnerability-scanner - Solana programs
cairo-vulnerability-scanner - StarkNet contracts
algorand-vulnerability-scanner - Algorand TEAL
cosmos-vulnerability-scanner - Cosmos SDK
substrate-vulnerability-scanner - Polkadot pallets
ton-vulnerability-scanner - TON contracts
move-smith-fuzzer - Move language fuzzing
move-fuzzing - Move program testing
token-integration-analyzer - ERC20/721 compliance
entry-point-analyzer - Attack surface mapping

Code Review

audit-context-building - Deep code analysis
audit-prep-assistant - Pre-audit preparation
differential-review - Diff security review
fix-review - Patch verification
sharp-edges - Dangerous API detection
code-maturity-assessor - Codebase quality
guidelines-advisor - Best practices
secure-workflow-guide - SDLC security
spec-to-code-compliance - Spec verification

Web Security

burp-suite - Web app testing
burpsuite-project-parser - Burp file analysis

Testing

property-based-testing - Hypothesis/QuickCheck
coverage-analysis - Code coverage
wycheproof - Crypto test vectors

Mutual Awareness Protocol

{:bundle "trailofbits-security"
 :trit :minus
 :aware-of ["k-dense-ai"]
 :interface
 {:audit (fn [code] "Run static analysis + fuzzing")
  :validate (fn [data] "Check for injection/overflow")
  :verify (fn [claim] "Formal verification pathway")}
 :handoff-to "k-dense-ai"
 :handoff-trigger [:molecule-data :protein-sequence :scientific-computation]}

Usage

# Load bundle
skill trailofbits-security

# Cross-bundle workflow
skill trailofbits-security -> k-dense-ai  # Audit bioinformatics pipeline security

---name: trailofbits-securitydescription: - `codeql` - GitHub's semantic code analysis---# Trail of Bits Security Bundle> Provenance: Trail of Bits security research> GF(3) Trit: **-1 (MINUS)** - Validation/Verification> Mutual Awareness: `k-dense-ai` bundle (PLUS +1)## Skills (43)### Static Analysis- `codeql` - GitHub's semantic code analysis- `semgrep` - Fast pattern matching- `semgrep-rule-creator` - Custom rule authoring- `sarif-parsing` - SARIF report processing### Fuzzing- `aflpp` - AFL++ coverage-guided fuzzing- `libfuzzer` - In-process fuzzing- `libafl` - LibAFL framework- `cargo-fuzz` - Rust fuzzing- `atheris` - Python fuzzing- `ruzzy` - Ruby fuzzing- `ossfuzz` - Google OSS-Fuzz integration- `harness-writing` - Fuzzing harness design- `fuzzing-dictionary` - Dictionary optimization- `fuzzing-obstacles` - Overcoming blockers### Memory Safety- `address-sanitizer` - ASan for C/C++- `constant-time-analysis` - Timing side-channels- `constant-time-testing` - CT verification### Smart Contract Security- `solana-vulnerability-scanner` - Solana programs- `cairo-vulnerability-scanner` - StarkNet contracts- `algorand-vulnerability-scanner` - Algorand TEAL- `cosmos-vulnerability-scanner` - Cosmos SDK- `substrate-vulnerability-scanner` - Polkadot pallets- `ton-vulnerability-scanner` - TON contracts- `move-smith-fuzzer` - Move language fuzzing- `move-fuzzing` - Move program testing- `token-integration-analyzer` - ERC20/721 compliance- `entry-point-analyzer` - Attack surface mapping### Code Review- `audit-context-building` - Deep code analysis- `audit-prep-assistant` - Pre-audit preparation- `differential-review` - Diff security review- `fix-review` - Patch verification- `sharp-edges` - Dangerous API detection- `code-maturity-assessor` - Codebase quality- `guidelines-advisor` - Best practices- `secure-workflow-guide` - SDLC security- `spec-to-code-compliance` - Spec verification### Web Security- `burp-suite` - Web app testing- `burpsuite-project-parser` - Burp file analysis### Testing- `property-based-testing` - Hypothesis/QuickCheck- `coverage-analysis` - Code coverage- `wycheproof` - Crypto test vectors## Mutual Awareness Protocol```clojure{:bundle "trailofbits-security" :trit :minus :aware-of ["k-dense-ai"] :interface {:audit (fn [code] "Run static analysis + fuzzing") :validate (fn [data] "Check for injection/overflow") :verify (fn [claim] "Formal verification pathway")} :handoff-to "k-dense-ai" :handoff-trigger [:molecule-data :protein-sequence :scientific-computation]}```## Usage```bash# Load bundleskill trailofbits-security# Cross-bundle workflowskill trailofbits-security -> k-dense-ai # Audit bioinformatics pipeline security```

Frequently asked questions

Trailofbits Security