trailofbits/skills-curated

COLLECTIONcommunity
trailofbitsCC-BY-SA-4.0Updated 21d agoGitHub

Curated, community-vetted Claude Code plugin marketplace

Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety. We don't want people at Trail of Bits installing random plugins from GitHub repos we haven't reviewed. Published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate. This repo is how we solve that problem…

This collection bundles
27 skills1 agent4 commands

⚠ The trust score below reflects the collection's repository only. The bundled units are not individually verified or scanned — review them before use.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
437GitHub stars
24Forks
21d agoLast update
Package
Authortrailofbits
LicenseCC-BY-SA-4.0
Sourcegithub
GitHubtrailofbits/skills-curated
Trust Status
B
60/100Good
✓Listed in Forge index+10/10
—Publisher identity verified+0/25
→ Publisher: run `forge publish` from the package repo to claim ownership
—Ed25519 publish signature+0/10
→ Included automatically when the publisher runs `forge publish`
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
—CVE scan · not run+0/30
→ Not yet scanned — package must be on npm
✓Static analysis · clean+20/20
—npm provenance (Sigstore)+0/5
→ Publish from GitHub Actions with the --provenance flag
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain—
Provenance—
DependenciesNot audited
Tool surface—
Security scan✓ CleanvHEAD · 19d ago
EvalsNone
IndexedJun 14, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts — it cannot prove the absence of malicious code.

About

Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety. We don't want people at Trail of Bits installing random plugins from GitHub repos we haven't reviewed. Published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate. This repo is how we solve that problem internally. Everything here has been code-reviewed by Trail of Bits staff. We're sharing it publicly so the…

Keywords
collection