Trail of Bits
Sources: Trail of Bits (homepage) · OSS AI Security Harness Comparison.
Identity and role
Trail of Bits is a security research and consulting firm. It publishes trailofbits/skills on GitHub, a marketplace of Claude Code and Codex plugins named in Semgrep’s July 2026 survey of open-source AI code-security harnesses.
Relevance to This Wiki
skills packages roughly 40 plugins, about 15 of them security-focused, under a CC-BY-SA licence, per Semgrep’s LLM-generated summary of the repository.1 Semgrep records the project at about 6K GitHub stars, tied with defending-code-harness for the highest count among the nine projects compared.2 Standouts named in the summary include c-review and rust-review, which orchestrate parallel Claude workers behind a deterministic Python planner and emit SARIF 2.1.0, and constant-time-analysis and zeroize-audit, which drop to assembly or LLVM IR to catch cryptographic timing leaks and compiler-eliminated secret wiping. Semgrep describes the collection’s strength as breadth and domain depth across native code, cryptography, and smart contracts spanning six blockchains: a toolbox of composable reviewers, distinct from the standalone pipelines elsewhere in the comparison.
Trail of Bits’ fp-check skill is one of four named instances of adversarial validation in Semgrep’s comparison, alongside Cloudflare’s Phase 3, VVAH’s S6, and defending-code-harness’s fresh-container grader.
Outputs / Products
- trailofbits/skills — plugin marketplace for Claude Code and Codex; standouts span native-code review, constant-time and secret-wiping analysis, and triage/expansion methodologies.1
See Also
- skills — the product covered here.
- OSS AI Security Harness Comparison — source.