trailofbits/skills plugin for Grok Build

Community Claude Code plugin, installs in GrokPluginSecurity

Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows

How to install trailofbits/skills in Grok Build

1. Add this repo as a plugin marketplace in Grok Build (once per computer):

grok plugin marketplace add trailofbits/skills

2. Install the plugin:

grok plugin install audit-context-building@trailofbits/skills --trust
✓ Install-checked in Grok Buildchecked Oct 18, 2026

Review before you trust it. --trust lets this plugin's hooks, MCP servers and scripts run code on your computer. It's a community repo that neither xAI nor GrokStacks has reviewed, so read its code first.

This repo's marketplace has 44 plugins; we checked audit-context-building, building-secure-contracts, burpsuite-project-parser. Install another the same way: grok plugin install <name>@trailofbits/skills --trust (names under 'What it contains'). Then start a new Grok session, or press r in /plugins, to load it.

Inside Grok Build: type /plugins, open the Marketplace tab, press a and add trailofbits/skills, then select audit-context-building and press i.

Command format: Grok Build's plugin guide

What we checked: on Oct 18, 2026 it installed with grok 1.0.62 and Grok found 14 skills, 1 slash command, 1 subagent. That's an install check only: we haven't run it in a live Grok session.

What it contains

Skills (14)

  • audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vuln
  • algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
  • audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stor
  • cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
  • code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing
  • cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IB
  • guidelines-advisor — Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, rev
  • secure-workflow-guide — Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuz
  • solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.
  • substrate-vulnerability-scanner — Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.
  • token-integration-analyzer — Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner priv
  • ton-vulnerability-scanner — Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.
  • burpsuite-project-parser — Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP t
  • burp-search — Searches Burp Suite project files for security analysis

Subagents (1)

  • audit-context-building:function-analyzer — Analyzes one function in depth for audit context: invariants, assumptions, and what its callees establish. Writes the prose analysis to disk and returns a compact record. Use for dense functions, data

Plugins in this marketplace (44)

  • audit-context-building — Understand a codebase before looking for bugs in it. Reads it function by function, records what each one assumes and depends on, and saves the write-ups to files instead of filling up the conversation.
  • building-secure-contracts — Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.
  • burpsuite-project-parser — Search and extract data from Burp Suite project files (.burp) for security analysis
  • chrome-mcp-troubleshooting — Diagnose and fix Claude in Chrome MCP extension connectivity issues
  • constant-time-analysis — Detect compiler-induced timing side-channels in cryptographic code
  • culture-index — Interprets Culture Index survey results for individuals and teams
  • devcontainer-setup — Create pre-configured devcontainers with Claude Code and language-specific tooling
  • differential-review — Security-focused differential review of code changes with git history analysis and blast radius estimation
  • firebase-apk-scanner — Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only.
  • gh-cli — Intercepts GitHub URL fetches (WebFetch and MCP fetch tools) and curl/wget commands, redirecting to the authenticated gh CLI.
  • dwarf-expert — Analyze DWARF debug information: parse and search DIEs with dwarfdump and readelf, verify debug info integrity, and write DWARF parsing code
  • entry-point-analyzer — Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level, and generates structured audit reports.
  • mutation-testing — Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.
  • post-patch-validation — Validates security patches against the reported bug, root-cause variants, and surrounding behavior. Returns reproducible failures to repair and validation gaps, with pinned inputs and saved evidence. Bundles a validate-patch dynamic workflow for Claude Code.
  • property-based-testing — Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants
  • semgrep-rule-creator — Create custom Semgrep rules for detecting bug patterns and security vulnerabilities
  • semgrep-rule-variant-creator — Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation
  • sharp-edges — Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes
  • static-analysis — Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection
  • spec-to-code-compliance — Check code against the documentation that specifies it: one agent per requirement, divergences refuted before they are reported, evidence cited to the line
  • testing-handbook-skills — Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)
  • trailmark — Builds source and binary code graphs for security analysis, context slicing, mutation testing, cryptographic protocol modeling, finding triage, and variant analysis.
  • variant-analysis — Find similar vulnerabilities and bugs across codebases using pattern-based analysis
  • c-review — Comprehensive C/C++ security code review, with coverage verified against a parse of the source
  • rust-review — Comprehensive Rust security code review with specialized bug-finding agents covering the safe/unsafe boundary, memory safety in unsafe blocks, concurrency, panic-induced DoS, recursion-induced stack overflow, FFI, and async runtime hazards
  • modern-python — Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools.
  • insecure-defaults — Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production
  • review-walkthrough — Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.
  • second-opinion — Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits.
  • yara-authoring — YARA-X detection rule authoring with linting and quality analysis
  • git-cleanup — Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.
  • goal-prompt — Drafts copy-ready /goal commands for goal mode in Claude Code and Codex: verifiable completion conditions with stop bounds, normalized to a single line under the 4,000-character cap.
  • supply-chain-risk-auditor — Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts
  • zeroize-audit — Detects missing or compiler-optimized zeroization of sensitive data with assembly and control-flow analysis
  • let-fate-decide — Draws the 12 Houses of the Zodiac Tarot spread using cryptographic randomness to add 100+ bits of entropy to vague or underspecified planning. Interprets the spread to guide next steps. Use when feeling lucky, invoking heart-of-the-cards energy, or when prompts are ambiguous.
  • agentic-actions-auditor — Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference)
  • code-improver — Improves code targets — skills, plugins, or a branch's changes — through an autonomous review-and-fix workflow with a pluggable reviewer (any installed skill or agent), a cross-round findings ledger, oscillation escalation, and a mechanical scope guard.
  • fp-check — Systematic false positive verification for security bug analysis with mandatory gate reviews
  • dimensional-analysis — Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value. Use when someone asks to audit or review code for unit confusion, decimals or scaling mismatches, WAD/RAY scale errors, or the wrong token's decimals; to annotate units in a co
  • vulnerability-triage-brocards — Principled framework for triaging vulnerability reports using 7 brocards (rules of thumb). Evaluates incoming CVEs, bug bounty submissions, and security findings against structured dismissal/acceptance criteria before escalating to deeper analysis.
  • github-triage — Triages a repository's open GitHub issues and pull requests via the gh CLI: optionally merges ready bot and maintainer-approved PRs and spawns review subagents for unreviewed ones, closes already-resolved issues with referenced explanations, cross-links issues with pending fix PRs, and assigns local
  • open-sourcing — Prepares a repository for public open-source release: secrets-history hygiene, license selection, documentation and CI readiness checks, and language-specific packaging and release guidance.
  • writing-lean-proofs — Structured Lean 4 proof writing and library design following Mathlib conventions
  • modern-cpp — Modern C++ best practices (C++20/23/26). Use when writing C++ code, creating new C++ projects, or modernizing legacy C++ patterns.

About this listing

trailofbits/skills is a community plugin on GitHub by trailofbits, written as a Claude Code plugin that Grok Build installs. We install-checked it in Grok; we haven't run it in a live session or reviewed its code. When we installed it, Grok found 14 skills, 1 subagent, 44 plugins in this marketplaces. Its license is CC-BY-SA-4.0. We checked commit 5c99c03fb8a9. It's one of 79 listings in the Security category on GrokStacks.

Stacks Weekly: every new Grok Build and Codex plugin, every Tuesday.

One short email for GrokStacks and CodexStacks readers, with each new plugin's install line and what it ships. Subscribe and get the free starter list: 20 Grok Build plugins worth installing first.

You'll get a confirmation email first. Unsubscribe anytime.

trailofbits/skills FAQ

How do I install trailofbits/skills in Grok Build?

Add the repo as a marketplace with grok plugin marketplace add trailofbits/skills, then run grok plugin install audit-context-building@trailofbits/skills --trust. This repo's marketplace has 44 plugins; we checked audit-context-building, building-secure-contracts, burpsuite-project-parser. Install another the same way: grok plugin install <name>@trailofbits/skills --trust (names under 'What it contains'). Then start a new Grok session, or press r in /plugins, to load it.

Is trailofbits/skills an official Grok Build plugin?

No. trailofbits/skills is a community plugin on GitHub by trailofbits, not in xAI's official Grok Build marketplace. We checked that it installs and what Grok loads from it, but haven't run it in a live Grok session or reviewed its code.

What does trailofbits/skills include?

According to what Grok loaded in our install check, trailofbits/skills includes 14 skills, 1 subagent, 44 plugins in this marketplaces: audit-context-building, algorand-vulnerability-scanner, audit-prep-assistant, cairo-vulnerability-scanner, code-maturity-assessor, cosmos-vulnerability-scanner….

Details

Type
Plugin
Category
Security
Source
Community Claude Code plugin, installs in Grok
License
CC-BY-SA-4.0
Author
trailofbits
Keywords
agent-skills
Source repo
https://github.com/trailofbits/skills
Checked commit
5c99c03fb8a9
Checked by GrokStacks
Install-checked in Grok Build on Oct 18, 2026; not run in a live session

Something wrong or missing? Submit or improve this listing. Marketplace listings also refresh automatically every night.

For maintainers: badge and embeds

Maintain trailofbits/skills? Add the badge; it links to this page.

Listed on GrokStacks

Markdown

[![Listed on GrokStacks](https://grokstacks.com/badge.svg)](https://grokstacks.com/p/trailofbits-skills/)

HTML

<a href="https://grokstacks.com/p/trailofbits-skills/"><img src="https://grokstacks.com/badge.svg" alt="Listed on GrokStacks" width="164" height="28"></a>

Embed card (static HTML and inline CSS, no JavaScript). Preview:

trailofbits/skillsCommunity plugin for Grok Build · 14 skills, 1 subagent, 44 plugins in this marketplacesTrail of Bits Claude Code skills for security research, vulnerability detection, and audit workflowsView on GrokStacks →
<a href="https://grokstacks.com/p/trailofbits-skills/" style="display:block;max-width:380px;box-sizing:border-box;padding:14px 16px;border:1px solid #2a2e3c;border-radius:12px;background:#0a0b0f;color:#e8eaf0;font:14px/1.45 -apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;text-decoration:none"><span style="display:block;font-size:16px;font-weight:700;color:#e8eaf0">trailofbits/skills</span><span style="display:block;margin:2px 0 8px;font-size:12px;color:#9aa0b1">Community plugin for Grok Build · 14 skills, 1 subagent, 44 plugins in this marketplaces</span><span style="display:block;margin:0 0 10px;color:#c9cdd8">Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows</span><span style="font-size:12px;font-weight:600;color:#7c9cff">View on GrokStacks →</span></a>

Markdown summary

**[trailofbits/skills on GrokStacks](https://grokstacks.com/p/trailofbits-skills/)**: Community plugin for Grok Build with 14 skills, 1 subagent, 44 plugins in this marketplaces. Install: `grok plugin install audit-context-building@trailofbits/skills --trust` (after `grok plugin marketplace add trailofbits/skills`)

More on badges, embeds and keeping your listing up to date: GrokStacks for plugin authors.

Also in Security

Aaron Marketing Skills

120 marketing skills as an AI marketing staff — plugin, portable skills, or an 8-bot team across 7 disciplines (narrative, SEO/GEO, social, email, paid, influencer, launch) on one contract, with 8 auditor gates: TALE · CORE-EEAT · CITE · ECHO · SEND · ROAS · STAR · RAMP.

Community Claude Code plugin, installs in GrokPluginSecurity

Adrian

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.

Community Claude Code plugin, installs in GrokPluginSecurity

Agent Beacon

The cross-harness, self-improving memory layer for AI agents. Join our community: https://discord.com/invite/zdNChS2fBu

Community Claude Code plugin, installs in GrokPluginSecurity

Agent Governance Toolkit

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.

Community Claude Code plugin, installs in GrokPluginSecurity

Agentguard

Security guard for AI agents — blocks malicious skills, prevents data leaks, protects secrets. 24 detection rules, runtime action evaluation, trust registry.

Community Claude Code plugin, installs in GrokPluginSecurity

Android Reverse Engineering Skill

Claude Code skill to support Android app's reverse engineering

Community Claude Code plugin, installs in GrokPluginSecuritySecurity tool

All 79 security listings →