Trail of Bits Skills

Name: Trail of Bits Skills (Claude Skill)
Author: trailofbits

Why use it

Key features

Written by a security firm, not a hobbyist — patterns reflect real incidents
Covers C/C++, Rust, Solidity, Python, Go, TypeScript
Defensive-only: audit/review flows, not offensive tooling
Modular — pull individual skills without adopting the whole bundle
CC-BY-SA-4.0 licensed, attribution required

Live Demo

What it looks like in practice

ready

Install

Author repository · Claude Skills documentation

Use Cases

Real-world ways to use Trail of Bits Skills

Add a security-review pass to every PR

👤 Teams without a dedicated security engineer ⏱ ~30 min intermediate

When to use: Your PRs currently go straight from code-review to merge — no security eyes.

Flow

Scope the diff

Use trailofbits/pr-review skill on the current PR. List files the skill thinks are security-relevant with reasons.✓ Copied

→ Concrete file-by-file relevance reasons
Deep review

For each flagged file, run the appropriate domain skill (crypto, input-validation, auth). Report findings with severity.✓ Copied

→ Severity-ranked list with code refs
Summary for reviewer

Write a 5-bullet PR comment summarizing the findings, non-scary but precise.✓ Copied

→ Reviewer-friendly summary with exact line citations

Outcome: A security review comment on every PR that catches real issues without drowning you in false positives.

Pitfalls

Skill flags style issues as security — Calibrate by prompting: "focus on exploitable issues only"

Combine with: github · filesystem

Audit cryptographic code paths in a service

👤 Devs maintaining auth/encryption code ⏱ ~90 min advanced

When to use: You have a JWT/HMAC/encryption layer and want someone smart to double-check.

Flow

Find crypto

Use trailofbits/crypto-review. Scan /src for files that touch crypto APIs. Report them.✓ Copied

→ Crypto call-site inventory
Audit each

For each site: what algorithm? Key management? Nonce reuse risk? IV handling? Cite source.✓ Copied

→ Per-site audit with code refs
Remediation plan

For any medium+ finding, draft a remediation — concrete code change, not "consider using ...".✓ Copied

→ Applicable diffs, not vague advice

Outcome: A crypto audit report with concrete fixes, from a baseline of common mistakes ToB has seen in real engagements.

Pitfalls

Not a substitute for a real audit — Use for self-review; hire professionals before launch of high-value surfaces

Combine with: github

Combinations

Pair with other MCPs for X10 leverage

trailofbits-skill + github

Post findings as a PR review comment

Post the review as a PR comment — severities as labels.✓ Copied

trailofbits-skill + filesystem

Scan the whole repo offline

Run the full security sweep across /src and write report to /audit/report.md.✓ Copied

Tools

What this MCP exposes

Tool	Inputs	When to call
scope_review	diff\|path	Before deep dive
crypto_review	path	Crypto code specifically
input_validation_review	path	API/boundary code
iac_review	path	Terraform / CloudFormation / K8s manifests

Cost & Limits

What this costs to run

API quota: N/A
Tokens per call: Review is reading-heavy; budget proportional to diff size
Monetary: Free (CC-BY-SA)
Tip: Scope first — don't run deep skills on irrelevant files

Security

Permissions, secrets, blast radius

Minimum scopes: filesystem-read

Credential storage: None

Data egress: None from skill; reviewed code is in your LLM context

Never grant: write access unless auto-remediating

Not a replacement for a formal security audit — use it to catch the obvious before paying for experts

Troubleshooting

Common errors and fixes

Skill flags safe code as vulnerable

Ask for rationale; if weak, dismiss with reason. Calibration improves over sessions.

Misses obvious bugs

The skill codifies Trail of Bits' patterns — if your stack is unusual (e.g. niche Rust crate), it may miss. Add custom patterns.

Outputs too long to review

Constrain: "top 5 highest-severity findings only"

Alternatives