trailofbits/skills

What trailofbits/skills is for

trailofbits/skills is an AI agent skill resource for Meta & Tools workflows. Based on the archived project material, its core value is: Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows — a GitHub Skill repository verified at commit 7be90d6 with 79 SKILL.md files for skill collections workflows.. This detail page focuses on the practical questions to answer before adopting the skill: what task it solves, how setup works, which README notes matter, where the local Markdown copy is available, and whether the workflow can be adapted for Claude, Codex, Gemini, Kimi, GLM, ChatGPT, or an internal AI agent.

README summary

> This is an EasyGlobe-authored bilingual repository brief, not a redistributed third-party Skill and not an installable copy of the repository. Review the upstream repository before use.

README capability notes

| Path | Frontmatter name | Frontmatter description | SHA-256 |

| --- | --- | --- | --- |

| plugins/agentic-actions-auditor/skills/agentic-actions-auditor/SKILL.md | agentic-actions-auditor | Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations....

Workflow fit and practical value

The current taxonomy places trailofbits/skills under Meta & Tools, with tags such as Skill Collections, agent-skills, GitHub Skills. That means the skill should be evaluated through the lens of repeatable work: what task it helps an AI agent perform, what context the agent needs, what output a user should expect, and whether the workflow can be reused as a team SOP. The archived README is used as the first source of truth whenever it includes feature lists, examples, setup notes, or usage guidance. The local Markdown download is useful for review, internal documentation, and adapting the instructions into your own agent skills repository.

Installation, usage, and platform notes

No explicit installation section was found in the archived README. Open the original source for the official setup path; the download button provides the local Markdown copy saved by EasyGlobe. Use this skill when the task involves Skill Collections, agent-skills, GitHub Skills. It can be adapted into Claude Skills, Codex Skills, Gemini Skills, Kimi Skills, GLM Skills, or a team SOP. If the README does not include a complete command-by-command setup path, the Skill URL remains the official source for the latest installation instructions. Platform support should be confirmed from the original project, but the information on this page is organized so it can be reused as a reference for Claude, Codex, Gemini, Kimi, GLM, ChatGPT, or internal AI agent workflows.

No standalone configuration section was detected in the archive. If the source project requires API keys, account auth, CLI setup, or plugin config, follow the Skill URL.