How trailofbits/skills works
This repository is a Claude Code plugin marketplace, also loadable by Codex and importable into ChatGPT workspaces. Users install or browse plugins, then invoke a selected skill or workflow for a task-specific result: security findings, validation evidence, analysis artifacts, or development guidance. The catalog spans auditing, static analysis, verification, malware analysis, and development workflows. The graph includes sampled workflow entry points and documented capabilities; several plugin implementations were not sampled, so their internal wiring is not inferred.
Main entry points: marketplace.json Plugin marketplace · audit-context.js Audit context · c-review.js C/C++ review · audit.js Insecure defaults
Components 23
Marketplace access
- Plugin marketplace
.claude-plugin/marketplace.json
Code auditing
- Audit context
plugins/audit-context-building/workflows/audit-context.js - C/C++ review
plugins/c-review/workflows/c-review.js - Insecure defaults
plugins/insecure-defaults/workflows/audit.js - Supply-chain audit
plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/scripts/collect.py - Findings and reports
plugins/c-review/scripts/assemble_findings.py
Analysis and verification
- Static analysis
plugins/static-analysis/workflows/semgrep-scan.js - Variant analysis
plugins/variant-analysis/workflows/variants.js - Spec compliance
plugins/spec-to-code-compliance/workflows/spec-compliance.js - Constant-time analysis
plugins/constant-time-analysis/ct_analyzer/analyzer.py - Patch validation
plugins/post-patch-validation/workflows/validate-patch.js - Zeroization audit
plugins/zeroize-audit/skills/zeroize-audit/tools/analyze_cfg.py - SARIF output
plugins/static-analysis/skills/semgrep/scripts/merge_sarif.py
Development workflows
- Code improvement
plugins/code-improver/workflows/improve.js - Git cleanup
plugins/git-cleanup/workflows/analyze-branches.js - Goal prompt
plugins/goal-prompt/skills/goal-prompt/scripts/format_goal_prompt.py
Specialist tools
- Semgrep rule porting
plugins/semgrep-rule-variant-creator/workflows/port-rule-to-languages.js - YARA authoring
plugins/yara-authoring/skills/yara-rule-authoring/scripts/yara_lint.py - Trailmark code tools
plugins/trailmark/skills/slicing-code-context/scripts/build_slice_packet.py
Other components
- Claude Code
- Codex
- ChatGPT workspace
- Agent runtime
Connections 38
- Claude Code → Plugin marketplace: browses or installs
- Codex → Plugin marketplace: loads marketplace
- ChatGPT workspace → Plugin marketplace: imports metadata
- Plugin marketplace → Audit context: makes available
- Plugin marketplace → C/C++ review: makes available
- Plugin marketplace → Insecure defaults: makes available
- Plugin marketplace → Supply-chain audit: makes available
- Plugin marketplace → Static analysis: makes available
- Plugin marketplace → Variant analysis: makes available
- Plugin marketplace → Spec compliance: makes available
- Plugin marketplace → Constant-time analysis: makes available
- Plugin marketplace → Patch validation: makes available
- Plugin marketplace → Zeroization audit: makes available
- Plugin marketplace → Code improvement: makes available
- Plugin marketplace → Git cleanup: makes available
- Plugin marketplace → Goal prompt: makes available
- Plugin marketplace → Semgrep rule porting: makes available
- Plugin marketplace → YARA authoring: makes available
- Plugin marketplace → Trailmark code tools: makes available
- Claude Code → Audit context: invokes workflow
- Claude Code → C/C++ review: invokes workflow
- Claude Code → Insecure defaults: invokes workflow
- Claude Code → Static analysis: invokes workflow
- Claude Code → Variant analysis: invokes workflow
- Claude Code → Spec compliance: invokes workflow
- Claude Code → Patch validation: invokes workflow
- Claude Code → Code improvement: invokes workflow
- Claude Code → Git cleanup: invokes workflow
- Claude Code → Semgrep rule porting: invokes workflow
- Audit context → Agent runtime: dispatches analysis
- Insecure defaults → Agent runtime: dispatches audit
- Spec compliance → Agent runtime: dispatches checks
- Patch validation → Agent runtime: dispatches validation
- Code improvement → Agent runtime: dispatches review and fixes
- Git cleanup → Agent runtime: dispatches investigation
- Semgrep rule porting → Agent runtime: dispatches porting
- C/C++ review → Findings and reports: assembles findings
- Static analysis → SARIF output: merges scan output