trailofbits-security
Installation
SKILL.md
Trail of Bits Security Skills
Security-focused static analysis and code auditing toolkit from Trail of Bits.
Available Sub-Skills
| Skill | File | Use When |
|---|---|---|
| CodeQL Analysis | codeql-SKILL.md | Deep interprocedural taint tracking, data flow analysis |
| Semgrep Scanning | semgrep-SKILL.md | Fast pattern-based security scanning with parallel execution |
| SARIF Parsing | sarif-parsing-SKILL.md | Processing and aggregating static analysis results |
When to Use
- Security audit of a codebase -> Start with Semgrep for speed, then CodeQL for depth
- Quick vulnerability scan -> Semgrep with "important only" mode
- Deep data flow analysis -> CodeQL with custom data extensions
- Processing scan results -> SARIF parsing for aggregation, deduplication, CI/CD integration