When your AI assistant needs a security clearance

What it does

Trail of Bits Skills is a marketplace of Claude Code plugins—“skills” in Anthropic’s vocabulary—that graft specialized security expertise onto a generalist coding assistant. The repository bundles 39 plugins across smart contract auditing, C/C++ review, YARA rule authoring, static analysis, and reverse engineering, plus a parallel .codex/skills/ tree for OpenAI Codex users.

The interesting bit

The project treats AI assistants as junior security staff who need proper tooling and checklists rather than oracles that magically find vulnerabilities. The Trophy Case section suggests the approach actually works: one listed find is a timing side-channel in ML-DSA signing caught by the constant-time-analysis skill.

Key highlights

• 39 plugins spanning code auditing, verification, malware analysis, mobile security, and infrastructure
• Includes unusual tools like dimensional analysis for unit mismatches, a zeroize-audit for compiler-eliminated secret scrubbing, and a let-fate-decide Tarot plugin for cryptographically random planning
• Supports both Claude Code marketplace installation and Codex via a sidecar skill tree
• CC BY-SA 4.0 licensed, with skill authoring guidelines in CLAUDE.md
• Maintained by Trail of Bits, a professional security audit firm

Caveats

• Several plugins are integrations with existing tools like Semgrep, CodeQL, and Burp Suite rather than standalone novel analyzers
• The Trophy Case documents only one confirmed bug find so far, so broader real-world hit rates remain unclear
• A handful of plugins (e.g., let-fate-decide, culture-index) are team-process or novelty tools rather than hard security tooling

Verdict

Security engineers already living in Claude Code should grab this. Casual developers are better off with a linter.