Trailofbits security
Skill georgekhananaev/claude-skills-vault/.claude/skills/trailofbits-security
A curated collection of high impact skills for Claude Code designed to supercharge the senior full stack workflow. This vault automates the repetitive parts of development like architectural reviews, TDD cycles, and PR management so you can stay in flow. It is a force multiplier for shipping clean, production ready code at scale. 🚀⚡️
npx -y skills add georgekhananaev/claude-skills-vault --skill trailofbits-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Security-focused static analysis and code auditing skills from Trail of Bits. Includes CodeQL deep analysis, Semgrep scanning, and SARIF result processing. Use when performing security audits, running static analysis, scanning for vulnerabilities, or processing scan results.
SKILL.md
1.6 KB, 313 tokens by cl100k_base, as published. Nobody here has run it
Trail of Bits Security Skills
Security-focused static analysis and code auditing toolkit from Trail of Bits.
Available Sub-Skills
| Skill | File | Use When |
|---|---|---|
| CodeQL Analysis | codeql-SKILL.md | Deep interprocedural taint tracking, data flow analysis |
| Semgrep Scanning | semgrep-SKILL.md | Fast pattern-based security scanning with parallel execution |
| SARIF Parsing | sarif-parsing-SKILL.md | Processing and aggregating static analysis results |
When to Use
- Security audit of a codebase -> Start with Semgrep for speed, then CodeQL for depth
- Quick vulnerability scan -> Semgrep with "important only" mode
- Deep data flow analysis -> CodeQL with custom data extensions
- Processing scan results -> SARIF parsing for aggregation, deduplication, CI/CD integration
Workflow
- Run Semgrep for fast initial scan (pattern-based)
- Run CodeQL for deep interprocedural analysis (data flow + taint tracking)
- Use SARIF parsing to aggregate, deduplicate, and prioritize findings
- Review and triage results by severity
Source
From trailofbits/skills - the static-analysis plugin.