Agent-Skills.md

Agent Skills: Trail of Bits Security Skills

Security-focused static analysis and code auditing skills from Trail of Bits. Includes CodeQL deep analysis, Semgrep scanning, and SARIF result processing. Use when performing security audits, running static analysis, scanning for vulnerabilities, or processing scan results.

UncategorizedID: georgekhananaev/claude-skills-vault/trailofbits-security

Repository

georgekhananaev/claude-skills-vault
georgekhananaevLicense: MIT
205

Install this agent skill to your local

pnpm dlx add-skill https://github.com/georgekhananaev/claude-skills-vault/tree/HEAD/.claude/skills/trailofbits-security

Skill Files

Browse the full folder contents for trailofbits-security.

Download Skill

Loading file tree…

.claude/skills/trailofbits-security/SKILL.md

Skill Metadata

Name
trailofbits-security
Description
Security-focused static analysis and code auditing skills from Trail of Bits. Includes CodeQL deep analysis, Semgrep scanning, and SARIF result processing. Use when performing security audits, running static analysis, scanning for vulnerabilities, or processing scan results.

Trail of Bits Security Skills

Security-focused static analysis and code auditing toolkit from Trail of Bits.

Available Sub-Skills

| Skill | File | Use When | |-------|------|----------| | CodeQL Analysis | codeql-SKILL.md | Deep interprocedural taint tracking, data flow analysis | | Semgrep Scanning | semgrep-SKILL.md | Fast pattern-based security scanning with parallel execution | | SARIF Parsing | sarif-parsing-SKILL.md | Processing and aggregating static analysis results |

When to Use

  • Security audit of a codebase -> Start with Semgrep for speed, then CodeQL for depth
  • Quick vulnerability scan -> Semgrep with "important only" mode
  • Deep data flow analysis -> CodeQL with custom data extensions
  • Processing scan results -> SARIF parsing for aggregation, deduplication, CI/CD integration

Workflow

  1. Run Semgrep for fast initial scan (pattern-based)
  2. Run CodeQL for deep interprocedural analysis (data flow + taint tracking)
  3. Use SARIF parsing to aggregate, deduplicate, and prioritize findings
  4. Review and triage results by severity

Source

From trailofbits/skills - the static-analysis plugin.