Trail of Bits Skills: security review for your own code

What it does

What it is

Trail of Bits is a well-known security company. They published a large set of skills for code review and security work. This entry covers the review-style ones.

differential-review checks a code change for security problems, using the git history.
insecure-defaults looks for settings that fail open, such as a default password.
supply-chain-risk-auditor checks the packages your project uses.

Who it helps

Developers who want a second look at their own code before release.

Rules

Test only code you own or may test in writing. Do not point these tools at other people's systems.

Be careful

An AI review can miss problems and can report problems that are not real. It does not replace a professional audit for important systems.

How to install

$ /plugin marketplace add trailofbits/skills

$ /plugin install differential-review@trailofbits

$ /plugin install insecure-defaults@trailofbits

$ /plugin install supply-chain-risk-auditor@trailofbits

How to use it

Open the code you own, then ask for a security review of a change, a search for unsafe default settings, or an audit of your package dependencies. Read each finding and check it before you act. Some findings are false alarms.

What to watch out for

Use these skills only on code you own or have written permission to test. Some skills in the collection are for deeper attack research; we list only the review ones.
Findings can be wrong. Check each one by hand.
Some skills call outside tools such as Semgrep or CodeQL, or fetch advisory data from the web.
The licence is CC-BY-SA-4.0. If you copy or change the skills and share them, you must credit the authors and use the same licence.

Licence and author

Licence: CC-BY-SA-4.0
Author: Trail of Bits
Source code: github.com/trailofbits/skills

How we tested it

We installed it on an empty test computer on 12 Oct 2026. Partly tested: installed in a clean test system, but its main features need an account or key we did not use.

Test level

We did not run any review. The insecure-defaults plugin installed with no skill files in its folder, so check its README before you rely on it. Tools such as Semgrep and CodeQL were not installed.

Technical details of the test

Date: 12 Oct 2026
Method: Added the marketplace and installed three plugins (differential-review, insecure-defaults, supply-chain-risk-auditor) with the Claude Code command line in a clean container with no account. All three showed as enabled. All 85 skill files in the repository have a name and a description, and 33 agent files have a name. The plugins were not run on real code.

Checked again on 12 Oct 2026

Sources

github.com/trailofbits/skills