# trailofbits/skills architecture

> Architecture diagram of the GitHub repository trailofbits/skills, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/trailofbits/skills
- Repository: https://github.com/trailofbits/skills

## Overview

This repository is a Claude Code plugin marketplace, also loadable by Codex and importable into ChatGPT workspaces. Users install or browse plugins, then invoke a selected skill or workflow for a task-specific result: security findings, validation evidence, analysis artifacts, or development guidance. The catalog spans auditing, static analysis, verification, malware analysis, and development workflows. The graph includes sampled workflow entry points and documented capabilities; several plugin implementations were not sampled, so their internal wiring is not inferred.

Main entry points: [`.claude-plugin/marketplace.json`](https://github.com/trailofbits/skills/blob/main/.claude-plugin/marketplace.json) (Plugin marketplace), [`plugins/audit-context-building/workflows/audit-context.js`](https://github.com/trailofbits/skills/blob/main/plugins/audit-context-building/workflows/audit-context.js) (Audit context), [`plugins/c-review/workflows/c-review.js`](https://github.com/trailofbits/skills/blob/main/plugins/c-review/workflows/c-review.js) (C/C++ review), [`plugins/insecure-defaults/workflows/audit.js`](https://github.com/trailofbits/skills/blob/main/plugins/insecure-defaults/workflows/audit.js) (Insecure defaults)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_marketplace["Marketplace access"]
  node_catalog["Plugin marketplace<br/>[marketplace.json]"]
end

subgraph group_audit["Code auditing"]
  node_audit_context["Audit context<br/>[audit-context.js]"]
  node_c_review["C/C++ review<br/>[c-review.js]"]
  node_insecure_defaults["Insecure defaults<br/>[audit.js]"]
  node_supply_chain["Supply-chain audit<br/>[collect.py]"]
  node_finding_artifacts["Findings and reports"]
end

subgraph group_analysis["Analysis and verification"]
  node_static_analysis["Static analysis<br/>[semgrep-scan.js]"]
  node_variant_analysis["Variant analysis<br/>[variants.js]"]
  node_spec_compliance["Spec compliance<br/>[spec-compliance.js]"]
  node_constant_time["Constant-time analysis<br/>[analyzer.py]"]
  node_post_patch["Patch validation<br/>[validate-patch.js]"]
  node_zeroize["Zeroization audit<br/>[analyze_cfg.py]"]
  node_sarif["SARIF output<br/>[merge_sarif.py]"]
end

subgraph group_development["Development workflows"]
  node_code_improver["Code improvement<br/>[improve.js]"]
  node_git_cleanup["Git cleanup"]
  node_goal_prompt["Goal prompt"]
end

subgraph group_specialist["Specialist tools"]
  node_semgrep_port["Semgrep rule porting"]
  node_yara["YARA authoring<br/>[yara_lint.py]"]
  node_trailmark["Trailmark code tools"]
end

node_claude(("Claude Code"))
node_codex(("Codex"))
node_workspace(("ChatGPT workspace"))
node_agent_runtime(("Agent runtime"))

node_claude -->|"browses or installs"| node_catalog
node_codex -->|"loads marketplace"| node_catalog
node_workspace -.->|"imports metadata"| node_catalog
node_catalog -->|"makes available"| node_audit_context
node_catalog -->|"makes available"| node_c_review
node_catalog -->|"makes available"| node_insecure_defaults
node_catalog -->|"makes available"| node_supply_chain
node_catalog -->|"makes available"| node_static_analysis
node_catalog -->|"makes available"| node_variant_analysis
node_catalog -->|"makes available"| node_spec_compliance
node_catalog -->|"makes available"| node_constant_time
node_catalog -->|"makes available"| node_post_patch
node_catalog -->|"makes available"| node_zeroize
node_catalog -->|"makes available"| node_code_improver
node_catalog -->|"makes available"| node_git_cleanup
node_catalog -->|"makes available"| node_goal_prompt
node_catalog -->|"makes available"| node_semgrep_port
node_catalog -->|"makes available"| node_yara
node_catalog -->|"makes available"| node_trailmark
node_claude -->|"invokes workflow"| node_audit_context
node_claude -->|"invokes workflow"| node_c_review
node_claude -->|"invokes workflow"| node_insecure_defaults
node_claude -->|"invokes workflow"| node_static_analysis
node_claude -->|"invokes workflow"| node_variant_analysis
node_claude -->|"invokes workflow"| node_spec_compliance
node_claude -->|"invokes workflow"| node_post_patch
node_claude -->|"invokes workflow"| node_code_improver
node_claude -->|"invokes workflow"| node_git_cleanup
node_claude -->|"invokes workflow"| node_semgrep_port
node_audit_context -->|"dispatches analysis"| node_agent_runtime
node_insecure_defaults -->|"dispatches audit"| node_agent_runtime
node_spec_compliance -->|"dispatches checks"| node_agent_runtime
node_post_patch -->|"dispatches validation"| node_agent_runtime
node_code_improver -->|"dispatches review and fixes"| node_agent_runtime
node_git_cleanup -->|"dispatches investigation"| node_agent_runtime
node_semgrep_port -->|"dispatches porting"| node_agent_runtime
node_c_review -->|"assembles findings"| node_finding_artifacts
node_static_analysis -->|"merges scan output"| node_sarif

click node_catalog "https://github.com/trailofbits/skills/blob/main/.claude-plugin/marketplace.json"
click node_audit_context "https://github.com/trailofbits/skills/blob/main/plugins/audit-context-building/workflows/audit-context.js"
click node_c_review "https://github.com/trailofbits/skills/blob/main/plugins/c-review/workflows/c-review.js"
click node_insecure_defaults "https://github.com/trailofbits/skills/blob/main/plugins/insecure-defaults/workflows/audit.js"
click node_supply_chain "https://github.com/trailofbits/skills/blob/main/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/scripts/collect.py"
click node_static_analysis "https://github.com/trailofbits/skills/blob/main/plugins/static-analysis/workflows/semgrep-scan.js"
click node_variant_analysis "https://github.com/trailofbits/skills/blob/main/plugins/variant-analysis/workflows/variants.js"
click node_spec_compliance "https://github.com/trailofbits/skills/blob/main/plugins/spec-to-code-compliance/workflows/spec-compliance.js"
click node_constant_time "https://github.com/trailofbits/skills/blob/main/plugins/constant-time-analysis/ct_analyzer/analyzer.py"
click node_post_patch "https://github.com/trailofbits/skills/blob/main/plugins/post-patch-validation/workflows/validate-patch.js"
click node_zeroize "https://github.com/trailofbits/skills/blob/main/plugins/zeroize-audit/skills/zeroize-audit/tools/analyze_cfg.py"
click node_code_improver "https://github.com/trailofbits/skills/blob/main/plugins/code-improver/workflows/improve.js"
click node_git_cleanup "https://github.com/trailofbits/skills/blob/main/plugins/git-cleanup/workflows/analyze-branches.js"
click node_goal_prompt "https://github.com/trailofbits/skills/blob/main/plugins/goal-prompt/skills/goal-prompt/scripts/format_goal_prompt.py"
click node_semgrep_port "https://github.com/trailofbits/skills/blob/main/plugins/semgrep-rule-variant-creator/workflows/port-rule-to-languages.js"
click node_yara "https://github.com/trailofbits/skills/blob/main/plugins/yara-authoring/skills/yara-rule-authoring/scripts/yara_lint.py"
click node_trailmark "https://github.com/trailofbits/skills/blob/main/plugins/trailmark/skills/slicing-code-context/scripts/build_slice_packet.py"
click node_finding_artifacts "https://github.com/trailofbits/skills/blob/main/plugins/c-review/scripts/assemble_findings.py"
click node_sarif "https://github.com/trailofbits/skills/blob/main/plugins/static-analysis/skills/semgrep/scripts/merge_sarif.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_catalog toneBlue
class node_audit_context,node_c_review,node_insecure_defaults,node_supply_chain,node_finding_artifacts toneAmber
class node_static_analysis,node_variant_analysis,node_spec_compliance,node_constant_time,node_post_patch,node_zeroize,node_sarif toneMint
class node_code_improver,node_git_cleanup,node_goal_prompt toneRose
class node_semgrep_port,node_yara,node_trailmark,node_claude,node_codex,node_workspace,node_agent_runtime toneIndigo
```

## Components

### Marketplace access

- [Plugin marketplace](https://github.com/trailofbits/skills/blob/main/.claude-plugin/marketplace.json): `.claude-plugin/marketplace.json`

### Code auditing

- [Audit context](https://github.com/trailofbits/skills/blob/main/plugins/audit-context-building/workflows/audit-context.js): `plugins/audit-context-building/workflows/audit-context.js`
- [C/C++ review](https://github.com/trailofbits/skills/blob/main/plugins/c-review/workflows/c-review.js): `plugins/c-review/workflows/c-review.js`
- [Insecure defaults](https://github.com/trailofbits/skills/blob/main/plugins/insecure-defaults/workflows/audit.js): `plugins/insecure-defaults/workflows/audit.js`
- [Supply-chain audit](https://github.com/trailofbits/skills/blob/main/plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/scripts/collect.py): `plugins/supply-chain-risk-auditor/skills/supply-chain-risk-auditor/scripts/collect.py`
- [Findings and reports](https://github.com/trailofbits/skills/blob/main/plugins/c-review/scripts/assemble_findings.py): `plugins/c-review/scripts/assemble_findings.py`

### Analysis and verification

- [Static analysis](https://github.com/trailofbits/skills/blob/main/plugins/static-analysis/workflows/semgrep-scan.js): `plugins/static-analysis/workflows/semgrep-scan.js`
- [Variant analysis](https://github.com/trailofbits/skills/blob/main/plugins/variant-analysis/workflows/variants.js): `plugins/variant-analysis/workflows/variants.js`
- [Spec compliance](https://github.com/trailofbits/skills/blob/main/plugins/spec-to-code-compliance/workflows/spec-compliance.js): `plugins/spec-to-code-compliance/workflows/spec-compliance.js`
- [Constant-time analysis](https://github.com/trailofbits/skills/blob/main/plugins/constant-time-analysis/ct_analyzer/analyzer.py): `plugins/constant-time-analysis/ct_analyzer/analyzer.py`
- [Patch validation](https://github.com/trailofbits/skills/blob/main/plugins/post-patch-validation/workflows/validate-patch.js): `plugins/post-patch-validation/workflows/validate-patch.js`
- [Zeroization audit](https://github.com/trailofbits/skills/blob/main/plugins/zeroize-audit/skills/zeroize-audit/tools/analyze_cfg.py): `plugins/zeroize-audit/skills/zeroize-audit/tools/analyze_cfg.py`
- [SARIF output](https://github.com/trailofbits/skills/blob/main/plugins/static-analysis/skills/semgrep/scripts/merge_sarif.py): `plugins/static-analysis/skills/semgrep/scripts/merge_sarif.py`

### Development workflows

- [Code improvement](https://github.com/trailofbits/skills/blob/main/plugins/code-improver/workflows/improve.js): `plugins/code-improver/workflows/improve.js`
- [Git cleanup](https://github.com/trailofbits/skills/blob/main/plugins/git-cleanup/workflows/analyze-branches.js): `plugins/git-cleanup/workflows/analyze-branches.js`
- [Goal prompt](https://github.com/trailofbits/skills/blob/main/plugins/goal-prompt/skills/goal-prompt/scripts/format_goal_prompt.py): `plugins/goal-prompt/skills/goal-prompt/scripts/format_goal_prompt.py`

### Specialist tools

- [Semgrep rule porting](https://github.com/trailofbits/skills/blob/main/plugins/semgrep-rule-variant-creator/workflows/port-rule-to-languages.js): `plugins/semgrep-rule-variant-creator/workflows/port-rule-to-languages.js`
- [YARA authoring](https://github.com/trailofbits/skills/blob/main/plugins/yara-authoring/skills/yara-rule-authoring/scripts/yara_lint.py): `plugins/yara-authoring/skills/yara-rule-authoring/scripts/yara_lint.py`
- [Trailmark code tools](https://github.com/trailofbits/skills/blob/main/plugins/trailmark/skills/slicing-code-context/scripts/build_slice_packet.py): `plugins/trailmark/skills/slicing-code-context/scripts/build_slice_packet.py`

### Other components

- **Claude Code**
- **Codex**
- **ChatGPT workspace**
- **Agent runtime**

## Connections

- Claude Code → Plugin marketplace: browses or installs
- Codex → Plugin marketplace: loads marketplace
- ChatGPT workspace → Plugin marketplace: imports metadata
- Plugin marketplace → Audit context: makes available
- Plugin marketplace → C/C++ review: makes available
- Plugin marketplace → Insecure defaults: makes available
- Plugin marketplace → Supply-chain audit: makes available
- Plugin marketplace → Static analysis: makes available
- Plugin marketplace → Variant analysis: makes available
- Plugin marketplace → Spec compliance: makes available
- Plugin marketplace → Constant-time analysis: makes available
- Plugin marketplace → Patch validation: makes available
- Plugin marketplace → Zeroization audit: makes available
- Plugin marketplace → Code improvement: makes available
- Plugin marketplace → Git cleanup: makes available
- Plugin marketplace → Goal prompt: makes available
- Plugin marketplace → Semgrep rule porting: makes available
- Plugin marketplace → YARA authoring: makes available
- Plugin marketplace → Trailmark code tools: makes available
- Claude Code → Audit context: invokes workflow
- Claude Code → C/C++ review: invokes workflow
- Claude Code → Insecure defaults: invokes workflow
- Claude Code → Static analysis: invokes workflow
- Claude Code → Variant analysis: invokes workflow
- Claude Code → Spec compliance: invokes workflow
- Claude Code → Patch validation: invokes workflow
- Claude Code → Code improvement: invokes workflow
- Claude Code → Git cleanup: invokes workflow
- Claude Code → Semgrep rule porting: invokes workflow
- Audit context → Agent runtime: dispatches analysis
- Insecure defaults → Agent runtime: dispatches audit
- Spec compliance → Agent runtime: dispatches checks
- Patch validation → Agent runtime: dispatches validation
- Code improvement → Agent runtime: dispatches review and fixes
- Git cleanup → Agent runtime: dispatches investigation
- Semgrep rule porting → Agent runtime: dispatches porting
- C/C++ review → Findings and reports: assembles findings
- Static analysis → SARIF output: merges scan output