Trail of Bits Skills Explained: Claude Code Security Skills

By Daniel GelfandPublished November 12, 202610 min read

Quick answer. Trail of Bits publishes openly licensed security skills as a Claude Code plugin marketplace, also loadable in Codex. Vet and pin a plugin, then build context, map entry points, run the secure-workflow checks and verify every lead with a test before trusting it.

Watch: Trail of Bits Skills Explained: Claude Code Security Skills 1:44

Video transcript

Trail of Bits publishes security skills for Claude Code, and Codex can load them. They can help structure a contract review, once you vet them.

A plugin can bundle instructions, agents, hooks and MCP servers. Installing one is a trust decision.

The building secure contracts plugin holds 11 skills. None of its six chain scanners targets Solidity.

Other skills map the system before any hunt, list externally callable state-changing entry points, check unusual token behaviors, and test leads for false positives.

Anthropic says to trust a plugin before installing. Record the commit, read every file, list hook and network access, test in a clean clone, then pin it.

Then build context, map entry points, run the secure workflow checks, write invariants, and prove each lead with a failing test.

The repository publishes no precision or recall benchmark. Read its descriptions as capability documentation, not measured coverage.

In Guardian's Veranta V2 review, finding I-13 showed a TWAP order checked at creation, not at execution, so slices could be skipped. Trusted keepers kept it Informational.

Skills give no independent assurance. Guardian's audit puts two independent teams on one scope: manual review with invariant fuzzing, and Helix, our AI auditor. That describes the service, not a measured comparison.

Read the full article for install commands and the vetting checklist, or talk to Guardian before your contracts hold funds.

What the Skills Are

A skill is a SKILL.md file of instructions, plus optional supporting files. Claude loads it when a request matches its description, or you run it directly as /<plugin>:<skill>. Anthropic

Trail of Bits publishes its security skills as a public plugin marketplace for Claude Code, and Codex can load the same marketplace. Trail of Bits

A plugin can bundle skills, agents, hooks, MCP servers, LSP servers, monitors and executables. Anyone can host a marketplace.

Installing one gives an agent new instructions, and sometimes new tools, inside your repository. That is useful, and it is a trust decision.

The marketplace groups plugins by job, including smart contract security, code auditing, verification, malware analysis, reverse engineering, mobile security and development.

This guide covers the plugins that matter for a contract review, how to install and vet them, and where they stop. For other AI auditing tools, see best AI tools for smart contract auditing.

Skills for Smart Contracts

Two plugins sit in the smart contract category: building-secure-contracts and entry-point-analyzer. Trail of Bits

building-secure-contracts holds 11 skills. Six are vulnerability scanners for Algorand, Cairo, Cosmos, Solana, Substrate and TON.

The other five are assistants for audit prep, code maturity, development guidelines, a secure workflow and token integration.

None of the six scanners targets Solidity. EVM coverage comes from the assistants and the Slither, Echidna and Manticore runs they drive.

token-integration-analyzer checks ERC20 and ERC721 conformity, owner privileges, upgradeability and onchain token distribution.

It also covers more than 20 unusual token behaviors, including fee-on-transfer, rebasing, missing return values, blocklists, flash minting and callback reentrancy.

entry-point-analyzer lists externally callable state-changing functions and classifies their access as public, role-restricted, contract-only or needing review.

It reads Solidity, Vyper, Solana Rust, Move, TON and CosmWasm code, and skips view and pure functions.

audit-context-building maps a codebase before any bug hunt. It writes a system dossier plus one file per function, and names no bugs, fixes or severities.

General plugins apply too. The table lists those most useful on contract code, with versions read from the marketplace on November 12, 2026.

Plugin	Version	Use in a contract review
building-secure-contracts	1.2.2	Chain scanners, secure workflow, token checks
entry-point-analyzer	2.0.0	Map of state-changing functions and access
audit-context-building	2.0.2	Assumptions and dependencies before hunting
property-based-testing	1.2.3	Write and review property-based tests
spec-to-code-compliance	2.0.2	Check code against its documentation
dimensional-analysis	3.2.0	Unit and decimal-scaling bugs, with dimensional comments
differential-review	1.1.4	Security review of changes, with git history
variant-analysis	2.0.4	Find similar bugs across codebases
fp-check	1.0.5	False positive checks with gate reviews

Installing the Skills From GitHub

Add the marketplace once, then enable only the plugins a review needs.

Claude Code: run /plugin marketplace add trailofbits/skills, then open /plugin menu to choose plugins. Trail of Bits
Codex: run codex plugin marketplace add trailofbits/skills, then codex plugin list to see what is offered.
Codex, per plugin: run codex plugin add <plugin-name>@trailofbits.
Use in Claude Code: ask in plain language, or run a skill directly, for example /building-secure-contracts:secure-workflow-guide. Anthropic
Tools: several skills call Slither, Echidna or Manticore. entry-point-analyzer falls back to manual analysis when Slither is missing or fails.
Housekeeping: plugins can be enabled and disabled, so switch off the ones you are not using.

Vetting a Skill Before Use

Anthropic tells users to trust a plugin before installing, updating or using it. Anthropic

It says it does not control or verify the MCP servers, files or other software inside plugins, and cannot promise they will not change.

A respected publisher does not remove that step. Vet the revision you run, not the name on it.

Plugins that ship MCP servers carry MCP risks too. Our MCP pentesting checklist covers tool poisoning and rug pulls, where a definition changes after approval.

Record the plugin version and the repository commit you reviewed.
Read every SKILL.md, agent definition and referenced script in full.
List what it can do: shell commands, network calls, MCP servers, hooks and file writes.
Check for dependencies fetched at install or run time.
Run it first in a disposable clone with no keys, .env files or cloud logins.
Before enabling, open .claude-plugin/plugin.json, hooks/hooks.json, monitors/monitors.json, .mcp.json and bin/. Hooks and monitors run without per-command prompts.
Check skill frontmatter for allowed-tools, which pre-approves listed tools without prompting.
After disabling a plugin, restart the session so its monitors stop.
Pin the tested revision, and diff it again before any update.

Running a Security Review

The skills chain into a review. The order below follows each skill's stated scope.

Reviewing the workflow guide's diagrams and documenting properties before fuzzing are manual work. Trail of Bits

Work on a frozen commit. Save every output with the commit hash so a second reviewer can repeat the run.

Build context with audit-context-building, and keep its open questions as hunting leads.
Map the attack surface with entry-point-analyzer, flagging every public state-changing function.
Run secure-workflow-guide steps one to three: Slither detectors, upgradeability and ERC checks, then inheritance and authorization diagrams.
Run token-integration-analyzer on every external token the protocol accepts.
Write invariants and properties for Echidna or Manticore, as step four asks.
Do step five by hand: privacy, front-running, cryptography and DeFi interactions.
Check each lead with fp-check, then prove it with a failing test before it enters a report.

What They Find and Miss

The skills are strongest at setup work: attack-surface maps, known detector patterns, token edge cases, invariant scaffolding and structured notes. Trail of Bits

Because the entry-point map skips read-only functions, map view functions that other contracts price against separately.

Pattern checks also struggle with protocol intent, economics, cross-contract state, deployment settings, offchain systems and multi-transaction sequences.

The repository publishes no precision, recall or false positive benchmark for these skills. Read its descriptions as capability documentation, not measured coverage.

A public Guardian finding shows a bug that needs more. In the Veranta V2 review, I-13 found a TWAP order's runtime was checked at creation but not at execution. Guardian

Execution only required a higher slice ID. An operator could run a six-slice, thirty-minute plan in back-to-back transactions, skip slices, or execute after the deadline.

The team said its keepers were trusted, so the finding was kept as an Informational trust-assumption observation and acknowledged.

No single line looked wrong. The bug lived between two code paths, a timed sequence and a trust model, which is typical of business logic vulnerabilities.

Skills vs a Professional Audit

Skills sharpen a developer's own review and make an audit faster to start. They do not provide independent assurance.

Guardian's smart contract audit puts two independent teams on one scope: expert manual review with invariant fuzzing, and Helix, Guardian's AI auditor. Guardian

These describe the service, not a measured comparison with the Trail of Bits skills. For how the two kinds of review divide the work, see hybrid AI and human audit.

Question	Skills you run	Guardian audit
Who verifies findings?	You	Humans, before anything reaches the report
Independent coverage?	One agent session	Two teams on one scope, cross-checked
Fuzzing?	Property scaffolding for Echidna or Manticore	Invariants fuzzed across reachable states
Proof?	Your own tests, if you write them	Proof-of-concept tests with findings
After fixes?	Rerun it yourself	Fix review; the invariant suite stays with you

Frequently Asked Questions

Are the Trail of Bits skills free to use?

Yes. The repository is public under CC BY-SA 4.0. If you share the skills, credit Trail of Bits and link the license. Mark any changes, and share adaptations under the same or a compatible license. Trail of Bits, Creative Commons

Can a skill read my keys or .env files?

Yes, if they sit where it runs. Skills act through your agent's tools, and your permission settings govern any tool a skill has not pre-approved. Plugin monitors run with your full user permissions, outside the sandbox. Anthropic

What do the audit prep and code maturity skills produce?

The audit prep assistant gives a pre-audit readiness checklist. The code maturity assessor scores a codebase across nine categories in a scorecard. Both get code ready for review; neither is a vulnerability scan. Trail of Bits

Sources

Shipping Contracts That Will Hold Funds?

Before launch, Guardian's smart contract audit puts two independent teams on your scope, with invariant fuzzing and only human-verified findings.

Talk to Guardian Explore the service