mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Scott Arciszewski
98b01ec8ff
* Expand let-fate-decide zodiac spread * let-fate-decide: address self-review nits - Compute ENTROPY_BITS from math.log2(math.comb(...)) so the dict cannot silently drift if the spread shape changes; test now verifies the formula and asserts the 100-bit floor. - Remove the ambiguous draw() wrapper (list-or-dict return); callers use explicit draw_zodiac_spread() / draw_cards() instead. - Extract _build_house_record() helper to bring draw_zodiac_spread() under the 50-line guideline. - Require --legacy explicitly for the positional count CLI; remove the implicit legacy flip when a bare integer was passed. - Generalize the rank-format test to all four minor suits. - Document test_reviewed_cards_avoid_unsafe_shortcuts as an exact-string regression guard rather than a semantic check. - SKILL.md: reframe example session as an explicit house-level fragment and note the draw agent's bullet output format. - README.md: correct the deck-shuffle description (two independent decks, not one 78-card shuffle); compute entropy text from formulas. - marketplace.json + plugin.json: sync description to mention the 12 Houses spread and the 100+ bit entropy budget. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * let-fate-decide: align SKILL.md description article with sibling surfaces PR review flagged the SKILL.md frontmatter said "Draws a 12 Houses..." while plugin.json, marketplace.json, and agents/draw.md all say "Draws the 12 Houses...". SPREAD_NAME is a single fixed spread, so "the" is correct. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * let-fate-decide: rename entropy_bits.minor_shuffle to minor_arcana PR review flagged inconsistent naming in the entropy_bits dict: major_arcana (deck-named) vs minor_shuffle (operation-named). The value is also log2(C(56,24)), an unordered selection — not log2(56!), a full shuffle — and every prose consumer (SKILL.md, README.md, the entropy_note f-string) already calls it "Minor Arcana selection". Rename for parallel structure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * let-fate-decide: address PR follow-up nits 1. agents/draw.md: tighten portent template prose from "3-5 concise bullets" to "3 concise bullets" — the fenced template has exactly 3 placeholders, and a Haiku-class model will follow the template literally rather than the looser range. SKILL.md's example session synced to match. 2. references/INTERPRETATION_GUIDE.md: rewrite the Special Patterns section for the 12-house spread. The previous patterns were carried over from the 4-card hand and were broken in the new geometry: "Multiple Major Arcana" was guaranteed (12 Majors per draw), "All One Suit" was mathematically impossible (each Minor suit has only 14 cards vs. 24 Minor draws), "All Reversed" dropped from 2^-4 to 2^-36, and "Court Card Progression in sequence" had no meaning across houses. Replaced with four patterns calibrated to the new baseline frequencies: heavy reversal count (>= 24 of 36), heavy single-suit concentration (>= 10 of 24 Minors), weighty Majors in critical houses (1/8/12), and court cards clustering in people houses (3/7/11). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * let-fate-decide: fix reversal percentile, focus/Domain drift, Step 1 heading - Correct "Heavy Reversal Count": P(X>=24) for Binomial(36, 0.5) is ~3.26%, so "6th percentile" was wrong in both magnitude and direction. Reword to "roughly the top 3% of draws". - Align each house focus string to its house file **Domain** line (Houses 6, 7, 8, 9, 12 differed in content; House 8 dropped "secrets"). Both surfaces reach the interpreter on the default --content path. - Add test_zodiac_focus_matches_house_domain to pin the two surfaces together. - Fix Step 1 heading to "Read Each House and Card File" to match its body. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
Trail of Bits Skills Marketplace
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows.
Also see: claude-code-config · skills-curated · claude-code-devcontainer · dropkit
Installation
Claude Code Marketplace
/plugin marketplace add trailofbits/skills
Browse and Install Plugins
/plugin menu
Codex
Codex-native skill discovery is supported via the sidecar .codex/skills/ tree in this repository.
Install with:
git clone https://github.com/trailofbits/skills.git ~/.codex/trailofbits-skills
~/.codex/trailofbits-skills/.codex/scripts/install-for-codex.sh
See .codex/INSTALL.md for additional details.
Local Development
To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:
cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills
Available Plugins
Smart Contract Security
| Plugin | Description |
|---|---|
| building-secure-contracts | Smart contract security toolkit with vulnerability scanners for 6 blockchains |
| entry-point-analyzer | Identify state-changing entry points in smart contracts for security auditing |
Code Auditing
| Plugin | Description |
|---|---|
| agentic-actions-auditor | Audit GitHub Actions workflows for AI agent security vulnerabilities |
| audit-context-building | Build deep architectural context through ultra-granular code analysis |
| burpsuite-project-parser | Search and extract data from Burp Suite project files |
| c-review | Comprehensive C/C++ security review with clustered parallel workers and SARIF output |
| differential-review | Security-focused differential review of code changes with git history analysis |
| dimensional-analysis | Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs |
| fp-check | Systematic false positive verification for security bug analysis with mandatory gate reviews |
| insecure-defaults | Detect insecure default configurations, hardcoded credentials, and fail-open security patterns |
| semgrep-rule-creator | Create and refine Semgrep rules for custom vulnerability detection |
| semgrep-rule-variant-creator | Port existing Semgrep rules to new target languages with test-driven validation |
| sharp-edges | Identify error-prone APIs, dangerous configurations, and footgun designs |
| static-analysis | Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing |
| supply-chain-risk-auditor | Audit supply-chain threat landscape of project dependencies |
| testing-handbook-skills | Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage |
| trailmark | Code graph analysis, Mermaid diagrams, mutation testing triage, and protocol verification |
| variant-analysis | Find similar vulnerabilities across codebases using pattern-based analysis |
Malware Analysis
| Plugin | Description |
|---|---|
| yara-authoring | YARA detection rule authoring with linting, atom analysis, and best practices |
Verification
| Plugin | Description |
|---|---|
| constant-time-analysis | Detect compiler-induced timing side-channels in cryptographic code |
| mutation-testing | Configure mewt/muton mutation testing campaigns — scope targets, tune timeouts, optimize long runs |
| property-based-testing | Property-based testing guidance for multiple languages and smart contracts |
| spec-to-code-compliance | Specification-to-code compliance checker for blockchain audits |
| zeroize-audit | Detect missing or compiler-eliminated zeroization of secrets in C/C++ and Rust |
Reverse Engineering
| Plugin | Description |
|---|---|
| dwarf-expert | Interact with and understand the DWARF debugging format |
Mobile Security
| Plugin | Description |
|---|---|
| firebase-apk-scanner | Scan Android APKs for Firebase security misconfigurations |
Development
| Plugin | Description |
|---|---|
| ask-questions-if-underspecified | Clarify requirements before implementing |
| devcontainer-setup | Create pre-configured devcontainers with Claude Code and language-specific tooling |
| gh-cli | Intercept GitHub URL fetches and redirect to the authenticated gh CLI |
| git-cleanup | Safely clean up git worktrees and local branches with gated confirmation workflow |
| let-fate-decide | Draw Tarot cards using cryptographic randomness to add entropy to vague planning |
| modern-python | Modern Python tooling and best practices with uv, ruff, and pytest |
| seatbelt-sandboxer | Generate minimal macOS Seatbelt sandbox configurations |
| second-opinion | Run code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on changes, diffs, or commits. Bundles Codex's built-in MCP server. |
| skill-improver | Iterative skill refinement loop using automated fix-review cycles |
| workflow-skill-design | Design patterns for workflow-based Claude Code skills with review agent |
Team Management
| Plugin | Description |
|---|---|
| culture-index | Interpret Culture Index survey results for individuals and teams |
Tooling
| Plugin | Description |
|---|---|
| claude-in-chrome-troubleshooting | Diagnose and fix Claude in Chrome MCP extension connectivity issues |
Infrastructure
| Plugin | Description |
|---|---|
| debug-buttercup | Debug Buttercup Kubernetes deployments |
Trophy Case
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
When reporting bugs you've found, feel free to mention:
Found using Trail of Bits Skills
| Skill | Bug |
|---|---|
| constant-time-analysis | Timing side-channel in ML-DSA signing |
Contributing
We welcome contributions! Please see CLAUDE.md for skill authoring guidelines.
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.