trailofbits/skills-curated

COLLECTIONcommunity
trailofbitsCC-BY-SA-4.0Updated 2mo agoGitHub

Curated, community-vetted Claude Code plugin marketplace

Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety. We don't want people at Trail of Bits installing random plugins from GitHub repos we haven't reviewed. Published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate. This repo is how we solve that problem…

This collection bundles
27 skills1 agent4 commands

⚠ The trust score below reflects the collection's repository only. The bundled units are not individually verified or scanned — review them before use.

Automatically indexed from public sources. Not yet verified by the developer on Forge.Claim this listing →
437GitHub stars
24Forks
2mo agoLast update
Package
Authortrailofbits
LicenseCC-BY-SA-4.0
Sourcegithub
Trust Status
B
60/100Good
Listed in Forge index+10/10
Publisher identity verified+0/30
Publisher: run `forge publish` from the repo to claim ownership
Domain verification+0/10
Not currently available for this listing type — the domain-verification check only runs for npm-backed packages today, so this row cannot be earned here yet regardless of what's hosted at the domain.
Prompt-injection scan · clean+30/30
Obfuscation / exfil scan · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusCommunity-indexed
PublisherUnverified
SignatureUnsigned
Domain
Provenance
DependenciesNot audited
Tool surface
Security scan✓ CleanvHEAD · 2mo ago
EvalsNone
IndexedJun 14, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts — it cannot prove the absence of malicious code.

About

Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety. We don't want people at Trail of Bits installing random plugins from GitHub repos we haven't reviewed. Published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate. This repo is how we solve that problem internally. Everything here has been code-reviewed by Trail of Bits staff. We're sharing it publicly so the…

Keywords
collection