trailofbits/skills

What it is

trailofbits/skills is a plugin marketplace from Trail of Bits for AI-assisted security analysis, testing and development. The same repository installs into Claude Code, Codex and ChatGPT workspaces. It is licensed CC BY-SA 4.0. The README lists related repos: claude-code-config, codex-config, skills-curated, trailmark, calcifier and coop. The page does not list the individual plugins, so check the marketplace browser for what is in it.

What to do

Claude Code:

/plugin marketplace add trailofbits/skills

Codex reads Claude plugin marketplaces directly, so the repo carries no Codex-specific metadata:

codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits

ChatGPT workspace: import the repo's .claude-plugin/marketplace.json. Any skill that includes agents/openai.yaml must also set interface.display_name and interface.short_description in that file, because plugin metadata does not supply them. If an import fails, publish a metadata fix and re-sync the repository in the workspace marketplace.

Local testing or development: go to the parent directory of the clone and add it by path. The README gives this command with /plugins in the plural, unlike the /plugin used above.

cd /path/to/parent  # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills

Contributing: AGENTS.md has the skill authoring guidelines. Run make check before pushing. It runs most of CI locally, and AGENTS.md says what it leaves out. Codex gives advisory reviews on eligible PRs from the repo itself. Maintainers can comment @codex review for a fast review or apply the deep-review label for a deeper one. Fork PRs are excluded.

Caveats

The README does not say which skills exist, what they cover or how well they work. Bugs found with the skills can be reported with the line "Found using Trail of Bits Skills".