Most Claude Code add-ons come from hobby projects and weekend experiments. This one doesn’t.

Trail of Bits is a real security firm — the kind companies hire to break into their own software before somebody else does. And they’ve published a marketplace of Claude Code security skills that anyone can install: code auditing, static analysis, supply-chain risk checks, and second-opinion reviews, all packaged as skills you browse and add one at a time.

It had 7,718 stars as of October 2026. But the star count isn’t the story. The story is who’s behind it. When a firm that does professional security audits for a living ships skills for your coding agent, that’s a different weight class than a random plugin repo.

Here’s what’s inside, how to install it, who it’s for — and the honest caveat the hype posts skip.

What the trailofbits/skills marketplace actually is

First, understand the shape of it. This is not one plugin. It’s a plugin marketplace — a collection of dozens of security skills published by Trail of Bits, and you install only the ones you need.

That matters. Security tooling is stack-specific. A skill that audits Rust code does nothing for your C++ project, and a YARA rule authoring skill is useless if you’re not hunting malware. The marketplace model means you browse the menu, pick the skills that match the stack you actually ship in, and skip the rest.

The marketplace works in Claude Code, and it works in Codex too — same marketplace, same skills, your call on which agent you run.

Inside the Claude Code security skills: audits, static analysis, supply chain, and more

Here’s the breakdown of what’s in the collection:

Code auditing. Dedicated auditing skills for Rust and C/C++ review — the languages where memory bugs turn into security incidents. This is a structured review pass over your code, run the way an auditor would approach it.

Static analysis with CodeQL and Semgrep. The marketplace includes skills that work with CodeQL and Semgrep, two of the standard static analysis tools serious teams run before they ship. These aren’t prompts pretending to be scanners — they’re skills built around real tooling.

Supply-chain risk auditing. Skills that audit your dependencies for supply-chain risk. This is the unglamorous one that matters most: modern breaches keep coming through compromised or risky dependencies, and checking your deps before you ship beats reading about them in a breach headline after.

YARA rule authoring. YARA is the pattern-matching language security researchers use to identify and classify malware. There’s a skill for authoring YARA rules — niche, but if that’s your world, you know exactly why it’s valuable.

Mutation testing. This one’s clever. Mutation testing deliberately introduces small changes into your code and checks whether your test suite catches them. If your tests pass even when the code is broken, your tests aren’t protecting you — they’re decoration. A skill that checks whether your tests actually catch bugs is a skill that tells you the truth.

Second-opinion reviews. There’s even a skill for second-opinion code review — a fresh security pass over code that’s already been “reviewed.” Every team has code that got a rubber stamp. This is the pass that catches what the first one missed.

How to install the marketplace

In Claude Code, you add the marketplace with one command:

/plugin marketplace add trailofbits/skills

Then open the plugin menu to browse and install only the skills you need:

/plugin

On Codex, the same marketplace is one command away:

codex plugin marketplace add trailofbits/skills

That’s the whole setup. Add the marketplace, open the menu, pick your skills. Start with ONE skill for the stack you actually ship in — not the whole marketplace. Get that one working properly before you expand.

The honest caveat: it’s a marketplace, not a magic button

Here’s the part the hype leaves out.

Some of these skills need their upstream tools installed first. The static analysis skills lean on Semgrep and CodeQL — if those tools aren’t on your machine, the skill that wraps them has nothing to run. A marketplace is not magic. You install one skill, set it up properly, then expand.

That’s not a flaw. That’s how real security tooling works. Professional auditors don’t push one button either — they run a stack of tools, each configured for the job. These skills bring that workflow into your coding agent, but the setup discipline is still on you.

Go in expecting an afternoon of proper setup for your first skill, not a sixty-second miracle, and you’ll get real value out of it.

Who should install these Claude Code security skills — and who should skip them

Install this if you ship code that other people depend on. If you’re vibe-coding apps at full speed — and I say that with love, because speed is the whole point of building with agents — these skills are how you audit what you built like a firm would. Ship fast AND get a real security pass. Those two things don’t have to fight each other.

Start the day before your next launch. Run an audit pass and a supply-chain check on the code you’re about to put in front of users. That’s the highest-value hour this marketplace can give you.

Skip it, for now, if you’re only writing throwaway scripts and prototypes that never leave your machine. There’s nothing to audit if nothing ships. And skip the full-marketplace install either way — grabbing everything at once just buries the two or three skills you’ll actually use.

FAQ

Is trailofbits/skills free?

Yes. It’s free and open source on GitHub, published by Trail of Bits. Some individual skills depend on upstream tools like Semgrep and CodeQL, which you install separately.

Do I need to install every skill in the marketplace?

No — and you shouldn’t. It’s a marketplace, not a bundle. Browse the plugin menu, install the skills that match your stack, and leave the rest. One skill set up properly beats twenty skills installed and ignored.

Does it work outside Claude Code?

Yes. The same marketplace can be added in Codex with codex plugin marketplace add trailofbits/skills. Same skills, same idea — pick the agent you already run.

The bottom line

A real security firm looked at the agent era and decided to ship its craft as installable skills. That’s the signal. The full Repo Week series this came from is rounded up here: https://bigjermsays.com/how-to-make-money-with-ai-build-a-system-not-a-side-hustle/. If you want the rest of the tools, templates, and systems I actually use, they’re in the shop: https://bigjermsays.com/shop/

Save this one for the day before your next launch. Your future self — the one who didn’t ship the vulnerability — says thanks.

Big Jerm