Echidna is a Haskell-based fuzzer that tests Ethereum smart contracts by trying call sequences to break user-defined invariants or Solidity assertions.
3.2K+1 this week436HaskellAGPL-3.0Updated 11 hours ago
trailofbits/skills
A marketplace of Trail of Bits agent skills and plugins for AI-assisted security auditing, testing, and secure development in Claude Code and Codex.
- Stars
- 8,045
- Forks
- 683
- Open issues
- 141
- Last commit
- 15 hours ago
What is it?
This repository is a plugin marketplace of agent skills built by Trail of Bits, a security firm. Each plugin packages a focused workflow, such as reviewing C/C++ or Rust code for security issues, auditing smart contracts, writing Semgrep or YARA rules, checking GitHub Actions workflows for risky AI agent setups, or auditing npm, PyPI, and Go dependencies for advisories.
Plugins are grouped by area: smart contract security, code auditing, malware analysis, verification (including mutation testing, property-based testing and Lean proofs), reverse engineering, and general development helpers such as modern C++ and Python practices. The marketplace installs with a single command in Claude Code and can be added to Codex through its plugin commands; the ChatGPT workspace import uses the same manifest.
The repository also includes contribution guidelines for skill authors and a `make check` target that runs most of the CI checks locally. Content is licensed under CC-BY-SA-4.0.
Key features
- 01Installs as a marketplace in Claude Code and Codex with a single command.
- 02Covers smart contract auditing, code review, static analysis, and dependency risk checks.
- 03Includes Semgrep and YARA rule authoring helpers.
- 04Provides verification skills such as mutation testing and property-based testing.
- 05Offers a local check target that runs most CI checks before pushing.
Use cases
- Security engineers auditing C, C++, Rust, or Solidity codebases with AI assistance.
- Teams checking dependencies for known advisories and risky install scripts.
- Developers writing custom Semgrep or YARA detection rules.
Quick start
- 1
Add the Claude Code marketplace from within Claude Code
/plugin marketplace add trailofbits/skills - 2
Browse and install plugins from the plugin menu
/plugin menu
Things to know
- Content is licensed CC-BY-SA-4.0, a share-alike license that requires derivative works to use the same license.
- Plugins are designed for Claude Code, Codex, or ChatGPT workspace marketplaces, so they do not run as standalone software.
In collections
Topics
FAQ
- What is skills?
- A marketplace of Trail of Bits agent skills and plugins for AI-assisted security auditing, testing, and secure development in Claude Code and Codex. This repository is a plugin marketplace of agent skills built by Trail of Bits, a security firm. Each plugin packages a focused workflow, such as reviewing C/C++ or Rust code for security issues, auditing smart contracts, writing Semgrep or YARA rules, checking GitHub Actions workflows for risky AI agent setups, or auditing npm, PyPI, and Go dependencies for advisories.
- Is skills free to use? What license does it have?
- skills is open source under the CC-BY-SA-4.0 license. Check the license terms before using it in commercial products.
- Is skills still maintained?
- Actively maintained. The last commit to skills was on Nov 6, 2026.
- What can I use skills for?
- Security engineers auditing C, C++, Rust, or Solidity codebases with AI assistance. Teams checking dependencies for known advisories and risky install scripts. Developers writing custom Semgrep or YARA detection rules.
- How do I install skills?
- Add the Claude Code marketplace from within Claude Code: /plugin marketplace add trailofbits/skills Browse and install plugins from the plugin menu: /plugin menu
- Where can I get skills?
- The source code and installation instructions are on GitHub: https://github.com/trailofbits/skills
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Free, open-source tool that runs dependency, code and domain security scans and turns the results into shareable HTML reports.
259+1 this week4PythonGPL-3.0Well maintainedUpdated 4 days ago
Reference implementation of an autonomous vulnerability discovery and patching pipeline for Claude, with interactive security skills for threat modeling, scanning, triage, and patching.
7.7K+35 this week638PythonOtherUpdated 3 months ago
Open source AI code review that runs a separate reviewer over your agent's changes before you push, for Claude Code, Codex, Cursor and Cline.
1.1K+1 this week78TypeScriptApache-2.0Updated 2 days ago
A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration and malicious code patterns.
2.7K+24 this week341PythonOtherUpdated 15 hours ago
Google's continuous fuzzing service for open source projects, running libFuzzer, AFL++ and Honggfuzz with sanitizers to find security bugs.
12.9K+94 this week3KShellApache-2.0Updated 15 hours ago