> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/trailofbits/skills/llms.txt
> Use this file to discover all available pages before exploring further.

# Trail of Bits Skills Marketplace

> Enhance AI-assisted security analysis, testing, and development workflows with specialized Claude Code plugins

<Note>
  A Claude Code plugin marketplace from Trail of Bits providing 35+ skills for security researchers, auditors, and developers.
</Note>

## What is Trail of Bits Skills?

Trail of Bits Skills Marketplace is a comprehensive collection of Claude Code plugins designed to enhance AI-assisted security analysis, testing, and development workflows. Built by security experts at Trail of Bits, these plugins provide specialized knowledge and tooling for everything from smart contract auditing to malware analysis.

## Key Features

<CardGroup cols={2}>
  <Card title="Smart Contract Security" icon="shield-check">
    Comprehensive vulnerability scanners for 6 blockchains including Solidity, Algorand, Cairo, Cosmos, Solana, and Substrate
  </Card>

  <Card title="Code Auditing" icon="magnifying-glass">
    Static analysis with CodeQL and Semgrep, differential review, false positive verification, and supply chain risk auditing
  </Card>

  <Card title="Verification & Testing" icon="check-circle">
    Property-based testing, constant-time analysis for crypto code, and specification-to-code compliance checking
  </Card>

  <Card title="Development Tools" icon="code">
    Modern Python tooling, devcontainer setup, GitHub CLI integration, and secure workflow patterns
  </Card>
</CardGroup>

## Why Use Trail of Bits Skills?

<AccordionGroup>
  <Accordion title="Built by Security Experts">
    Every plugin is authored by Trail of Bits security researchers with deep expertise in their domains. Skills are based on proven methodologies from real-world security audits.
  </Accordion>

  <Accordion title="35+ Specialized Plugins">
    From smart contract security to YARA rule authoring, from constant-time analysis to Firebase APK scanning—there's a skill for every security task.
  </Accordion>

  <Accordion title="Trophy Case: Real Vulnerabilities Found">
    Skills have discovered production bugs including timing side-channels in ML-DSA signing implementations. When you find bugs, you can credit Trail of Bits Skills.
  </Accordion>

  <Accordion title="Open Source & Community Driven">
    Licensed under Creative Commons Attribution-ShareAlike 4.0. Contributions welcome with comprehensive authoring guidelines.
  </Accordion>
</AccordionGroup>

## Get Started

<CardGroup cols={3}>
  <Card title="Installation" icon="download" href="/installation">
    Add the marketplace to Claude Code in seconds
  </Card>

  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Browse and install your first plugin
  </Card>

  <Card title="Browse Plugins" icon="grid" href="/plugins/building-secure-contracts">
    Explore all 35 available plugins
  </Card>
</CardGroup>

## Plugin Categories

### Smart Contract Security

* **building-secure-contracts** - Security toolkit with vulnerability scanners for 6 blockchains
* **entry-point-analyzer** - Identify state-changing entry points for security auditing

### Code Auditing

* **static-analysis** - CodeQL, Semgrep, and SARIF parsing toolkit
* **differential-review** - Security-focused review of code changes with git history analysis
* **variant-analysis** - Find similar vulnerabilities across codebases
* **audit-context-building** - Build deep architectural context through ultra-granular analysis
* **fp-check** - Systematic false positive verification with mandatory gate reviews

### Verification

* **constant-time-analysis** - Detect compiler-induced timing side-channels in cryptographic code
* **property-based-testing** - Property-based testing guidance for multiple languages and smart contracts
* **spec-to-code-compliance** - Specification-to-code compliance checker for blockchain audits
* **zeroize-audit** - Detect missing or compiler-eliminated zeroization of secrets

### Development

* **modern-python** - Modern Python tooling with uv, ruff, and pytest
* **devcontainer-setup** - Pre-configured devcontainers with Claude Code and language-specific tooling
* **gh-cli** - Authenticated GitHub CLI integration
* **second-opinion** - Code reviews using external LLMs (OpenAI Codex, Google Gemini)

[See all 40+ plugins →](/plugins)

## Community & Support

<Card title="Found a Bug Using Skills?" icon="trophy">
  Trail of Bits maintains a Trophy Case of vulnerabilities discovered using these skills. Found something? [Let us know!](https://github.com/trailofbits/skills/issues/new?template=trophy-case.yml)

  When reporting bugs, feel free to mention: *Found using [Trail of Bits Skills](https://github.com/trailofbits/skills)*
</Card>

## Related Projects

* [claude-code-config](https://github.com/trailofbits/claude-code-config) - Configuration templates
* [skills-curated](https://github.com/trailofbits/skills-curated) - Curated skill collections
* [claude-code-devcontainer](https://github.com/trailofbits/claude-code-devcontainer) - Development containers
* [dropkit](https://github.com/trailofbits/dropkit) - Additional tooling

## License

This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License](https://creativecommons.org/licenses/by-sa/4.0/). Made by [Trail of Bits](https://www.trailofbits.com/).