Trail of Bits Skills
Security-research skill marketplace incl.
- Sato Score60
Trail of Bits Skills is a skill repo by Trail of Bits, with last code activity on 2026-10-07 (Active). Sato Score 60/100 (how open, active and verifiable it is, not a safety grade), as of 2026-10-15. How the score works →
See how to install Trail of Bits Skills →Last commit Oct 7, 2026 · ★ 7,450
Listed from github.com/trailofbits/skills on 2026-07-13. Install: not attempted. Evidence →
Next step
Watch Trail of Bits Skills
One email if what we observe changes — its repo goes quiet or disappears, or the listing is retired. Nothing else.
Check it from your agent
Add Sato Hub’s MCP server (no key), then ask:
https://satohub.ai/api/mcpRun Sato Hub Preflight on trailofbits/skills before I use it.Your project?
Prove you control the domain and correct this page — description, links, tags, chains. A claim proves control, not verification: it never changes the Sato Score.
Claim this listing →Overview
Trail of Bits Skills is a marketplace of 50+ Claude Code / Codex plugins from the security research firm Trail of Bits, spanning smart-contract vulnerability scanning and entry-point analysis, C/C++/Rust code auditing, static analysis, mutation and property-based testing, and reverse engineering. Security engineers and builders load the smart-contract skills into an agent to run structured vulnerability scans against Solidity/EVM code as part of a review workflow, not as an automated audit or safety guarantee.
Sato Score
60/100· MediumHow open, active & verifiable — not a safety or returns grade.
- Maintenance & liveness
- 35/35
- Code transparency
- 12/20
- Interface verifiability
- 0/10
- Docs & demo
- 0/10
- Listing transparency & provenance
- 11/15
- Independent verification
- 2/10
Evidence — listed vs checked · what the words mean
Listed from github.com/trailofbits/skills on 2026-07-13. Install: not attempted.
| Claim | Value | Evidence | Source | Checked |
|---|---|---|---|---|
| Chains supported | not stated | self-reported | github.com/trailofbits/skills | as of 2026-10-15 |
| Verification status | Self-Reported — not independently reviewed | self-reported | github.com/trailofbits/skills | as of 2026-10-15 |
| Recent activity | last commit 2026-10-07 | observed | github.com/trailofbits/skills | 2026-10-15 |
| Install works | documented by the project, not run by Sato Hubnot attempted: no falsifiable install+entry probe from deploy_spec | self-reported | github.com/trailofbits/skills | as of 2026-09-14 |
| Website answers | answered (HTTP 200) | observed | github.com/trailofbits/skills | 2026-10-15 |
| Daily check record | 89 of 90 daily checks since 2026-07-17 succeededa success rate of our checks, not uptime; the source is this listing's own history | observed | — | 2026-10-14 |
| Deploys as | Claude Code pluginconfidence 0.80 | self-reported | github.com/trailofbits/skills | as of 2026-07-14 |
| Works with | Claude Code, Codexconfidence 0.80 | self-reported | github.com/trailofbits/skills | as of 2026-07-14 |
| Sato Score | 60/100 (Medium)how open, active and verifiable — not a safety or quality grade | computed | satohub.ai | 2026-10-15 |
Self-reported rows are the project’s own words, dated when we recorded them — not a check. Only reproduced and reviewed rows carry a mark. None of these rows is a safety or quality rating.
Install — not run by us — no falsifiable install+entry probe from deploy_spec
Runtime: claude-code-plugin
/plugin marketplace add trailofbits/skills /plugin menu # browse and install individual plugins, e.g. building-secure-contracts, entry-point-analyzer, supply-chain-risk-auditor
Read from the project’s own docs as of 2026-09-14. What a deploy spec is →
Observed record — 91 daily checks since 2026-07-17
- Succeeded
- 90
- Failed
- 1
- Their error
- 0
- Unattributed
- 1
State changed on 2026-09-21 (responding → unreachable from our probe), 2026-09-22 (unreachable from our probe → responding).
This is the share of our daily checks that succeeded — not an availability guarantee. A check can fail because the host was down, because our runner timed out, or because the network in between dropped it, and only the first of those is a fact about this project. Failures are split by what we can attribute; anything we cannot attribute is counted, not hidden. 46 of these checks predate 2026-09-01, when the probe counted a bot-block (HTTP 403) as a failure and recorded no reason for any failure. Every one of them passed, so the rate covers them too.
Last 30 days — to 2026-10-15, one point per UTC day
A gap is a day we have no attributable observation — never a zero. Thirty points is the whole shape the free layer carries; the daily rows behind it stay in the snapshot series.
Skills that target this — 2, with disclosures
solana-vulnerability-scannerskills.sh · trailofbits
5,381 installsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.
cosmos-vulnerability-scannerskills.sh · trailofbits
5,032 installs"Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x."
Disclosures describe what a skill declares and does; they are not safety verdicts. All skills →
Details
- Chains
- Unknown
- Agent types
- Skill, Infrastructure
- Open source
- Unknown
- Deploys as
- Claude Code plugin
- Works with
- Claude Code, Codex
- Last checked
- 2026-10-15
Marketplace Signals
No marketplace signals recorded for this resource yet.
Verification status reflects evidence reviewed by Sato Hub. Self-reported claims are never presented as verified.
Listing History
Recorded changes to Trail of Bits Skills's listing — status, verification, Sato Score, and recent releases. Full history is kept in the listing record.
- Jul 18, 2026Sato Hub began tracking this listing
- Jul 14, 2026Auto-enriched: deployment options, supported integrations
- Jul 13, 2026Listed on Sato Hub
Compared with
Related Resources
GOAT SDK
ActiveCrossmint's open-source library of onchain actions (tools) for AI agents across chains.
Solana Agent Kit
ActiveSendAI's open-source toolkit connecting AI agents to Solana protocol actions.
Surf (asksurf.ai)
ActiveAn installable skill and unified API giving AI agents access to crypto market, on-chain, social, and prediction-market data across 40+ chains.
Reference
QuestionsWhat people ask about this pageShowHide
Questions people ask about Trail of Bits Skills
- Is Trail of Bits Skills open source?
- Unknown. Sato Hub has not found a public repository or a license statement for Trail of Bits Skills as of 2026-10-15.
- Which chains does Trail of Bits Skills support?
- Sato Hub has no confirmed chain list for Trail of Bits Skills as of 2026-10-15; treat chain support as unknown.
- Is Trail of Bits Skills still maintained?
- The most recent code activity Sato Hub observed was on 2026-10-07 (last commit 2026-10-07), which Sato Hub labels "Active". Posts on X are not counted as maintenance. Activity is a recency signal, not a quality judgment.
- How do I install or run Trail of Bits Skills?
- claude-code-plugin. Install: /plugin marketplace add trailofbits/skills. Entry: /plugin menu # browse and install individual plugins, e.g. building-secure-contracts, entry-point-analyzer, supply-chain-risk-auditor. This is taken from the project's own documentation and has not been reproduced by Sato Hub.
- Is Trail of Bits Skills verified on Sato Hub?
- No independent verification is on record for Trail of Bits Skills; its verification status is "Self-Reported" and its Sato Score is 60 of 100. Self-reported is not verified, and the score is not a safety, quality or returns grade.
Cite this pagePlain text, APA or BibTeXShowHide
Cite this page
Sato Hub. "Trail of Bits Skills — Sato Hub." Sato Hub, updated 2026-10-15, accessed 2026-10-15. https://satohub.ai/resources/trailofbits-skillsData last refreshed 2026-10-15; this page is rebuilt daily. Citations carry the date so a reader can tell which snapshot a claim came from. Catalog data is licensed CC-BY-4.0.
Join the Sato Hub Briefing
Sign up for the Briefing: the agents, tools, and infrastructure that actually shipped, and why they matter.