Trail of Bits Skills
Choose the review stage, then follow the evidence
A marketplace of 46 plugins for code understanding, security review, testing, and development support. Choose the workflow that fits the question; each produces different evidence and artifacts.
Hosts listed by the author
- Claude Code
- Codex
- GitHub stars
- 7,878
- Checked
- Categories
- EngineeringContent & Knowledge
Start with one clearly bounded change
Prepare two resolvable Git commits and explain the intended change. Use differential-review to obtain a report with code locations. Bring an existing suspicious finding to fp-check, and an existing fix to post-patch-validation, so each stage has an input you can inspect.
Pick a task and get started
Enter these commands in a Claude Code session. Add the marketplace once, install the relevant plugin, and reload as required by the host. Install another plugin when changing tasks. These are chat commands, not shell commands.
For a PR, commit, or patch with an explicit baseline. Provide the local repository, two revisions, expected behavior, and a report directory.
Install the plugin for this task
Add the marketplace and install differential-review inside Claude Code. Install the relevant plugin for later tasks; an existing marketplace need not be added again. Keep the complete plugin and confirm it loaded before invoking it.
Read the author’s setup guide/plugin marketplace add trailofbits/skills /plugin install differential-review@trailofbitsCheck the local repository and both revisions
Confirm that BASE and HEAD resolve to full commit IDs. State whether you want a comparison between two endpoints or changes since the branches’ common ancestor. Preserve uncommitted work and inspect history with read-only commands such as git show and git diff. Use the project’s approved isolated environment if execution becomes necessary. After installation, confirm that the differential-review skill and diff-review command are available before sending the first task.
Read the diff-review argumentsGive your AI this first task
These are editorial task briefs, not completed audits. Replace the bracketed paths, revisions, and context before use; placeholders are not real targets.
/differential-review:diff-review [HEAD commit] --baseline [BASE commit] Repository: [local path]. Compare the two endpoints. Intended change and behavior that must remain: [details]. Trust boundaries and attacker capabilities: [details]. Save the report to [separate report directory]. Resolve and record full commit IDs and inspect the current working tree first. Use read-only Git commands to inspect both revisions without switching or overwriting my uncommitted work. Read methodology.md, adversarial.md, and reporting.md. Establish the baseline invariants, classify changes by actual behavior, and inspect removed checks, historical fixes, callers, error paths, and existing tests. If audit-context-building is unavailable, build the relevant baseline directly; do not assume a system command with that name exists. Search hits are candidate references, not confirmed callers. For each finding, give the revision, file and line, actual path from input to affected operation, preconditions, protections, and concrete impact. Missing test changes are not proof of a vulnerability. Do not invent coverage percentages without measurement. Deliver a Markdown report and recommendations, listing files read and omitted, static reasoning, checks not run, and next steps. Do not execute target code, edit target source files, post PR comments, or merge anything in this task.
Check what you receive
- A Markdown differential-review report with full base/head revisions and the actual scope.
- Findings traceable to code, history, and confirmed callers, with test gaps separated from established defects.
- Check the assumptions and protections behind each major finding. APPROVE or REJECT in the report is a recommendation, not a merge action.
More about this skill
Trail of Bits packages security-analysis and testing practices as individually installable plugins. The inspected commit registers 46 plugins: some build an understanding of unfamiliar code, some review changes, some verify existing findings, and others examine dependencies or validate patches. A plugin can contain several skills, agents, scripts, hooks, and workflows; the plugin count is not a count of independent scanners.
The useful starting point is a precise question: which invariant did this change break, can external input reach the dangerous operation, does an advisory match the dependency version actually used, or did a patch fix only the original trigger? The five tasks below address those questions with concrete inputs, entry points, outputs, and checks.
Read each workflow’s result on its own terms. Differential review produces Markdown; supply-chain auditing separates collected data from model advice; Rust review records coverage and exports SARIF; patch validation distinguishes failures found from evidence missing. A generated report, zero findings, or a passing check only makes sense alongside the scope and execution state.
Sources and verification
Sources checked
Prepared from the marketplace, selected plugin documents, and key references at commit 2be6433. Supporting workflows were checked through documentation and structure; no third-party audit, exploit, or patch test was executed.