Skip to main content

Security Skills Integration

Trail of Bits security skills integration guide for comprehensive vulnerability detection and secure development.

Prerequisites​

  • Claude Code CLI installed and authenticated
  • Python 3.11+ (for skills that require Python)
  • Git (for version control operations)

Step 1: Add the Trail of Bits Marketplace​

/plugin marketplace add trailofbits/skills

Step 2: Install Core Security Skills​

Essential Security Review Skills​

SkillPurposeCommand
Audit Context BuildingDeep line-by-line analysis/plugin install trailofbits/skills/plugins/audit-context-building
Differential ReviewRisk-based PR review/plugin install trailofbits/skills/plugins/differential-review
Variant AnalysisFind similar vulnerabilities/plugin install trailofbits/skills/plugins/variant-analysis
Fix ReviewValidate security patches/plugin install trailofbits/skills/plugins/fix-review

Static Analysis & Detection​

SkillPurposeCommand
Static AnalysisCodeQL, Semgrep, SARIF/plugin install trailofbits/skills/plugins/static-analysis
Semgrep Rule CreatorCustom detection rules/plugin install trailofbits/skills/plugins/semgrep-rule-creator
Insecure DefaultsDangerous fail-open configs/plugin install trailofbits/skills/plugins/insecure-defaults

Specialized Security​

SkillPurposeCommand
Constant-Time AnalysisTiming side-channels/plugin install trailofbits/skills/plugins/constant-time-analysis
Property-Based TestingSystematic testing/plugin install trailofbits/skills/plugins/property-based-testing

Step 3: Verify Installation​

/plugin menu      # List installed plugins
/skills           # List available skills

Using Trail of Bits Skills​

Direct Invocation​

/trailofbits:differential-review @file1.py @file2.py

Natural Language​

Simply describe what you need:

"Review this security patch to ensure it fixes the root cause"

Claude will automatically invoke the appropriate skill.

Pull Request Security Review​

Step 1: /trailofbits:audit-context-building @src/
Step 2: /trailofbits:differential-review @changed-files
Step 3: /trailofbits:static-analysis @src/
Step 4: /trailofbits:variant-analysis (if vulnerabilities found)
Step 5: /secure-code-reviewer (your custom agent)

New Feature Security Assessment​

Step 1: /trailofbits:ask-questions-if-underspecified
Step 2: /security-engineer "Threat model this feature"
Step 3: /backend-engineer (design review)
Step 4: /trailofbits:differential-review
Step 5: /trailofbits:constant-time-analysis (if crypto involved)

Best Practices​

Layer Your Security Reviews​

  1. Automated: static-analysis
  2. Pattern-Based: semgrep-rule-creator
  3. Manual: secure-code-reviewer + differential-review
  4. Exploratory: variant-analysis

Document Findings​

## [SEVERITY] Vulnerability Title
**Skill Used:** trailofbits:differential-review
**CWE:** CWE-89 (SQL Injection)
**File:** path/to/file.py:42
**Description:** ...
**Remediation:** ...

Skill Reference​

SkillPrimary Use CaseOutput
audit-context-buildingDeep understandingArchitectural insights
differential-reviewPR security reviewVulnerability report
variant-analysisSimilar bug detectionPattern-based findings
fix-reviewPatch validationRoot cause assessment
static-analysisAutomated scanningTool-aggregated results
semgrep-rule-creatorCustom detectionSemgrep YAML rules
insecure-defaultsConfig reviewDangerous defaults list
constant-time-analysisCrypto reviewTiming vulnerabilities

Resources​