Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Originally from OpenAI's curated skills catalog.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety.
We don't want people at Trail of Bits installing random plugins from GitHub repos we haven't reviewed. Published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate. This repo is how we solve that problem internally.
Everything here has been code-reviewed by Trail of Bits staff. We're sharing it publicly so the broader community benefits from the same vetting.
/plugin marketplace add trailofbits/skills-curated
/plugin menu
| Plugin | Description |
|---|---|
| planning-with-files | File-based planning with persistent markdown for complex multi-step tasks |
| python-code-simplifier | Simplify and refine Python code for clarity and maintainability |
| react-pdf | Generate PDF documents with React-PDF (flexbox layout, SVG, custom fonts) |
| skill-extractor | Extract reusable skills from work sessions |
| Plugin | Description |
|---|---|
| ffuf-web-fuzzing | Expert guidance for ffuf web fuzzing during authorized penetration testing |
| ghidra-headless | Reverse engineer binaries using Ghidra's headless analyzer |
| scv-scan | Audit Solidity codebases for 36 smart contract vulnerability classes |
| security-awareness | Recognize and avoid phishing, credential theft, and social engineering during agent operation |
| wooyun-legacy | Web vulnerability testing methodology from 88,636 real-world cases (WooYun 2010-2016) |
| Plugin | Description |
|---|---|
| last30days | Research any topic from the last 30 days across Reddit, X, and the web |
| x-research | Search X/Twitter for real-time perspectives, discussions, and expert opinions |
| Plugin | Description |
|---|---|
| humanizer | Identifies and removes AI writing patterns to make text sound natural |
Auto-converted from openai/skills using scripts/convert_openai_skills.py. Portable skills only (no MCP or OpenAI API dependencies).
| Plugin | Description |
|---|---|
| openai-cloudflare-deploy | Deploy applications to Cloudflare Workers and Pages |
| openai-develop-web-game | Build and iterate on web games (HTML/JS) with a dev + testing loop |
| openai-doc | Read, create, and edit .docx documents with formatting fidelity |
| openai-gh-address-comments | Address review and issue comments on GitHub PRs |
| openai-gh-fix-ci | Debug and fix failing GitHub Actions CI checks |
| openai-jupyter-notebook | Create, scaffold, and edit Jupyter notebooks |
| openai-netlify-deploy | Deploy web projects to Netlify using the CLI |
| openai-pdf | Read, create, and review PDF files with layout awareness |
| openai-playwright | Automate real browsers from the terminal via playwright-cli |
| openai-screenshot | Take desktop or system screenshots |
| openai-security-best-practices | Language and framework specific security best-practice reviews |
| openai-security-ownership-map | Build security ownership topology from git history |
| openai-security-threat-model | Repository-grounded threat modeling with trust boundaries and abuse paths |
| openai-sentry | Inspect Sentry issues and summarize production errors |
| openai-spreadsheet | Create, edit, and analyze spreadsheets (.xlsx, .csv) |
| openai-yeet | Stage, commit, push, and open a GitHub PR in one flow |
There are three ways to get a skill approved for use:
The marketplaces below have been reviewed and are approved for use. Install plugins from them directly.
npx claudepluginhub botnotstrawberry/trailofbits-skills-curated --plugin openai-security-best-practicesAudits Solidity codebases for smart contract vulnerabilities using a four-phase workflow covering 36 vulnerability classes.
Simplifies and refines Python code for clarity, consistency, and maintainability while preserving all functionality.
Teaches agents to recognize and avoid security threats during normal activity. Covers phishing detection, credential protection, domain verification, and social engineering defense. Use when building or operating agents that access email, credential vaults, web browsers, or sensitive data.
File-based planning with persistent markdown files for complex multi-step tasks
Extract reusable skills from work sessions. Manual invocation only - no hooks, no noise.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Develop, test, build, and deploy Godot 4.x games with Claude Code. Includes GdUnit4 testing, web/desktop exports, CI/CD pipelines, and deployment to Vercel/GitHub Pages/itch.io.
Comprehensive feature development workflow with specialized agents for codebase exploration, architecture design, and quality review
Harness-native ECC operator layer - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
Design fluency for frontend development. 1 skill with 23 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.
UI/UX design intelligence. 67 styles, 161 palettes, 57 font pairings, 25 charts, 15 stacks (React, Next.js, Vue, Svelte, Astro, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui, Nuxt, Jetpack Compose). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient.