Trailofbits security

Skill georgekhananaev/claude-skills-vault/.claude/skills/trailofbits-security

Security-focused static analysis and code auditing skills from Trail of Bits. Includes CodeQL deep analysis, Semgrep scanning, and SARIF result processing. Use when performing security audits, running static analysis, scanning for vulnerabilities, or processing scan results.From its SKILL.md

Install

npx -y skills add georgekhananaev/claude-skills-vault --skill trailofbits-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

1.6 KB, 313 tokens by cl100k_base, as published. Nobody here has run it

Trail of Bits Security Skills

Security-focused static analysis and code auditing toolkit from Trail of Bits.

Available Sub-Skills

Skill	File	Use When
CodeQL Analysis	codeql-SKILL.md	Deep interprocedural taint tracking, data flow analysis
Semgrep Scanning	semgrep-SKILL.md	Fast pattern-based security scanning with parallel execution
SARIF Parsing	sarif-parsing-SKILL.md	Processing and aggregating static analysis results

When to Use

Security audit of a codebase -> Start with Semgrep for speed, then CodeQL for depth
Quick vulnerability scan -> Semgrep with "important only" mode
Deep data flow analysis -> CodeQL with custom data extensions
Processing scan results -> SARIF parsing for aggregation, deduplication, CI/CD integration

Workflow

Run Semgrep for fast initial scan (pattern-based)
Run CodeQL for deep interprocedural analysis (data flow + taint tracking)
Use SARIF parsing to aggregate, deduplicate, and prioritize findings
Review and triage results by severity

Source

From trailofbits/skills - the static-analysis plugin.

What ships with it: 3 files

40.0 KB alongside SKILL.md