claude

static-analysis

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

0 on GitHubby Axel Mierczuk & Paweł Płatekv1.2.2CC-BY-SA-4.0updated 4 months ago
/

Plugin static-analysis from marketplace trailofbits in RUSHYOP/mirror-trailofbits-skills. Commands read from the repo's manifest — 1 month ago.

What it installs

Skills (3)

  • codeql

    Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experime

  • sarif-parsing

    Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SA

  • semgrep

    Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when aske

Subagents (1)

  • semgrep-scanner

    Executes Semgrep CLI scans for a specific language category and produces SARIF output. Spawned by the semgrep skill as a parallel worker — one agent per detected language.

View source on GitHub

More from RUSHYOP/mirror-trailofbits-skills

All 40 plugins →

testing-handbook-skills

claude

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills

0

zeroize-audit

claude

Detects missing or compiler-optimized zeroization of sensitive data with assembly and control-flow analysis

1 skill · 11 agents · 1 MCP server

0

building-secure-contracts

claude

Comprehensive smart contract security toolkit based on Trail of Bits' Building Secure Contracts framework. Includes vulnerability scanners for 6 blockchains and 5 development guideline assistants.

11 skills

0

trailmark

claude

Builds multi-language source code graphs for security analysis: call graphs, attack surface mapping, blast radius, taint propagation, complexity hotspots, and entry point enumeration. Generates Mermaid diagrams (call graphs, class hierarchies, dependency maps, heatmaps). Compares code graph snapshots for structural diff and evolution analysis. Runs graph-informed mutation testing triage (genotoxic). Generates mutation-driven test vectors (vector-forge). Extracts crypto protocol message flows and converts Mermaid diagrams to ProVerif models. Projects SARIF and weAudit findings onto code graphs. Use when analyzing call paths, mapping attack surface, visualizing code architecture, triaging survived mutants, generating cryptographic test vectors, diagramming crypto protocols, formally verifying protocols, or augmenting audits with static analysis findings.

10 skills

0

dimensional-analysis

claude

Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol. Prevents dimensional mismatches and catches formula bugs early.

1 skill · 5 agents

0

fp-check

claude

Systematic false positive verification for security bug analysis with mandatory gate reviews

1 skill · 3 agents · hooks

0

Maintain static-analysis?

This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.

claude & codex plugins40 plugins