Trail of Bits skills

Install

/plugin marketplace add trailofbits/skills
/plugin menu

This is third-party code. Review the repository files before installing.

What it does

A marketplace for Claude Code and Codex with plugins for security analysis, testing and development. It includes smart contract vulnerability scanners, C/C++ and Rust security review, Semgrep and YARA rule authoring, static analysis with CodeQL and SARIF, and npm, PyPI and Go dependency audits. Other plugins cover fuzzing, mutation and property-based testing, APK and DWARF analysis, and modern C++ and Python development.

Who it is for. Application security engineers, smart contract auditors and developers who care about code security.

Example request

Create a Semgrep rule that finds SQL queries built with string concatenation in our Python code

Limitations

Many plugins rely on external tools such as Semgrep, CodeQL, fuzzers and Burp Suite. The license is CC BY-SA 4.0 rather than the usual MIT or Apache for code.

How to disable. Remove plugins through /plugin menu in Claude Code or the Codex plugin commands.

Security check

• Skills run shell commands and external analyzers
• The second-opinion plugin sends code to external LLM CLIs

README in short

A plugin marketplace from Trail of Bits for AI-assisted security analysis, testing and development. Plugins are grouped into smart contract security, code auditing, malware analysis, verification, reverse engineering, mobile security, development and tooling. The README includes a trophy case of bugs found with the skills. CC BY-SA 4.0 license.

SKILL.md

---
name: semgrep-rule-creator
description: Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
allowed-tools: Bash Read Write Edit Glob Grep WebFetch
---

# Semgrep Rule Creator

Create production-quality Semgrep rules with proper testing and validation.

## When to Use

**Ideal scenarios:**
- Writing Semgrep rules for specific bug patterns
- Writing rules to detect security vulnerabilities in your codebase
- Writing taint mode rules for data flow vulnerabilities
- Writing rules to enforce coding standards

## When NOT to Use

Do NOT use this skill for:
- Running existing Semgrep rulesets
- General static analysis without custom rules (use `static-analysis` skill)

## Rationalizations to Reject

When writing Semgrep rules, reject these common shortcuts:

- **"The pattern looks complete"** → Still run `semgrep --test --config <rule-id>.yaml <rule-id>.<ext>` to verify. Untested rules have hidden false positives/negatives.
- **"It matches the vulnerable case"** → Matching vulnerabilities is half the job. Verify safe cases don't match (false positives break trust).
- **"Taint mode is overkill for this"** → If data flows from user input to a dangerous sink, taint mode gives better precision than pattern matching.
- **"One test is enough"** → Include edge cases: different coding styles, sanitized inputs, safe alternatives, and boundary conditions.
- **"I'll optimize the patterns first"** → Write correct patterns first, optimize after all tests pass. Premature optimization causes regressions.
- **"The AST dump is too complex"** → The AST reveals exactly how Semgrep sees code. Skipping it leads to patterns that miss syntactic variations.

## Anti-Patterns

**Too broad** - matches everything, useless for detection:
```yaml
# BAD: Matches any function call
pattern: $FUNC(...)

# GOOD: Specific dangerous function
pattern: eval(...)
```

**Missing safe cases in tests** - leads to undetected false positives:
```python
# BAD: Only tests vulnerable case
# ruleid: my-rule
dangerous(user_input)

# GOOD: Include safe cases to verify no false positives
# ruleid: my-rule
dangerous(user_input)

# ok: my-rule
dangerous(sanitize(user_input))

# ok: my-rule

Related