Trail of Bits Security Skills

Turn Claude Code into a security research partner that catches vulnerabilities professional auditors miss. Trail of Bits — the firm behind Slither, Echidna, and hundreds of high-profile security audits — distilled decades of offensive security expertise into 40+ specialized agent skills that transform how you approach code security. These skills don't just run linters; they teach Claude Code to think like an attacker, systematically hunting for vulnerability variants, analyzing supply chain risks, verifying constant-time implementations, and authoring detection rules with the rigor of a professional red team. The collection spans nine categories covering the full security lifecycle. Smart contract auditors scan six blockchain platforms for known vulnerability patterns. Static analysis skills orchestrate CodeQL and Semgrep with expert-crafted queries, then validate findings to cut through false positives. The variant analysis workflow takes a known CVE and hunts for similar patterns across your codebase — the same technique that uncovered a real timing side-channel vulnerability in the RustCrypto/signatures library, proving these skills find bugs that matter in production cryptographic code. Beyond offense, verification skills bring defensive depth: property-based testing generates edge-case inputs, spec-to-code compliance checks implementations against formal specifications, and constant-time analysis flags cryptographic timing leaks. Supply chain auditing inspects dependency trees for typosquatting, abandoned maintainers, and known-vulnerable transitive dependencies. Development skills round out the collection with Git workflow automation, devcontainer setup, and Python modernization — because secure code starts with solid engineering practices.