# trailofbits/skills repository brief

> This is an EasyGlobe-authored bilingual repository brief, not a redistributed third-party Skill and not an installable copy of the repository. Review the upstream repository before use.

## English

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

EasyGlobe verified this public, non-fork, non-archived repository at commit `7be90d6e55e6b5e1607b519e97d0019b32b2656a`. The sampled tree contains 79 `SKILL.md` files and at least one sampled file has valid `name` and `description` frontmatter. Its primary directory category is Skill Collections. Static sampling did not find the high-risk credential-exfiltration or destructive-root-delete patterns checked by the research pipeline; this is not a full security audit.

## 中文

trailofbits/skills 是一个面向Skill 合集工作流的 GitHub Skill 仓库。EasyGlobe 在提交 `7be90d6e55e6b5e1607b519e97d0019b32b2656a` 对公开、非 fork、未归档的默认分支进行了抽样核验：仓库树包含 79 个 `SKILL.md` 文件，且至少一个抽样文件具有有效的 `name` 与 `description` frontmatter。静态抽样未命中本流水线检查的凭据外传或根目录破坏性命令模式；这不等同于完整安全审计，使用前仍应检查上游仓库。

## Repository metadata

| Field | Value |
| --- | --- |
| Repository | [trailofbits/skills](https://github.com/trailofbits/skills) |
| Hot rank / score | 33 / 50.73 |
| Stars at verification | 6753 |
| Default branch | `main` |
| Sampled commit | `7be90d6e55e6b5e1607b519e97d0019b32b2656a` |
| Last push | 2026-08-20T16:26:59Z |
| Verified | 2026-08-21T03:25:24.715Z |
| License | CC-BY-SA-4.0 |
| SKILL.md paths in sampled tree | 79 |

## Representative valid Skill evidence

| Path | Frontmatter name | Frontmatter description | SHA-256 |
| --- | --- | --- | --- |
| `plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md` | agentic-actions-auditor | Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations. | `80e36ab06e3ee667ac45bab036ed395fc425c4d54fa72c4b4981a5b982a389aa` |
| `plugins/audit-context-building/skills/audit-context-building/SKILL.md` | audit-context-building | Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass. | `222efa73743565a8fdb42e9bd08e9649c739fa0abc11129b35d267c9814b5916` |
| `plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md` | algorand-vulnerability-scanner | Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). | `55e5336040e0f24ac5b3d6258ac458cd7cbd9ae0f7db5541fe4ed95c10b58c58` |
| `plugins/building-secure-contracts/skills/audit-prep-assistant/SKILL.md` | audit-prep-assistant | Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). | `ea7db549ff26a57ebd101140dd8ed44434d5c91f3d91efc8927541bea8dd23e8` |
| `plugins/building-secure-contracts/skills/cairo-vulnerability-scanner/SKILL.md` | cairo-vulnerability-scanner | Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. | `3408b4d0ea2e618255e5715683626e7ebe0c10ae3c7929b19bb6af023a1d77f9` |

Source: https://github.com/trailofbits/skills