Curated Skills Marketplace

Trail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety.

Why This Exists

We don't want people at Trail of Bits installing random plugins from GitHub repos we haven't reviewed. Published skills have been found with backdoors and malicious hooks, and the ecosystem has no built-in quality gate. This repo is how we solve that problem internally.

Everything here has been code-reviewed by Trail of Bits staff. We're sharing it publicly so the broader community benefits from the same vetting.

Installation

/plugin marketplace add trailofbits/skills-curated
/plugin menu

Available Plugins

Development

Security

Productivity

Research

Writing

OpenAI (Converted)

Auto-converted from openai/skills using scripts/convert_openai_skills.py. Portable skills only (no MCP or OpenAI API dependencies).

How It Works

There are three ways to get a skill approved for use:

1. Use an approved marketplace

The marketplaces below have been reviewed and are approved for use. Install plugins from them directly.

2. Request approval of a new marketplace

Found a marketplace not on the list? Open an issue requesting approval. Include the repo URL and what you're using it for. We'll review it and add it to the approved list if it passes.

3. Submit an individual skill

Using a skill from an unapproved source? Open a PR to add it here. See CLAUDE.md for authoring guidelines. Every PR gets code review — we read every line of hooks and scripts.

When submitting an external skill, include attribution in the plugin's README: where it came from (link to the original repo or author) and any modifications you made. See the humanizer README for an example.

Once merged, the skill is available to all Trail of Bits employees and anyone else using this marketplace.

License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

{
  "name": "skills-curated",
  "owner": {
    "name": "Trail of Bits",
    "email": "opensource@trailofbits.com"
  },
  "metadata": {
    "version": "1.0.0",
    "description": "Curated, community-vetted Claude Code plugins reviewed for quality and safety"
  },
  "plugins": [
    {
      "name": "humanizer",
      "version": "2.2.0",
      "description": "Remove signs of AI-generated writing from text. Detects and fixes inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases.",
      "author": {
        "name": "blader",
        "url": "https://github.com/blader/humanizer"
      },
      "source": "./plugins/humanizer"
    },
    {
      "name": "skill-extractor",
      "version": "1.0.0",
      "description": "Extract reusable skills from work sessions. Manual invocation only - no hooks, no noise.",
      "author": {
        "name": "Trail of Bits",
        "email": "opensource@trailofbits.com",
        "url": "https://github.com/trailofbits"
      },
      "source": "./plugins/skill-extractor"
    },
    {
      "name": "planning-with-files",
      "version": "1.0.0",
      "description": "File-based planning with persistent markdown files for complex multi-step tasks",
      "author": {
        "name": "OthmanAdi",
        "url": "https://github.com/OthmanAdi"
      },
      "source": "./plugins/planning-with-files"
    },
    {
      "name": "ffuf-web-fuzzing",
      "version": "1.0.0",
      "description": "Expert guidance for ffuf web fuzzing during authorized penetration testing, including authenticated fuzzing, auto-calibration, and result analysis",
      "author": {
        "name": "jthack",
        "url": "https://github.com/jthack"
      },
      "source": "./plugins/ffuf-web-fuzzing"
    },
    {
      "name": "wooyun-legacy",
      "version": "1.0.0",
      "description": "Web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016)",
      "author": {
        "name": "tanweai / wooyun-legacy contributors",
        "url": "https://github.com/tanweai/wooyun-legacy"
      },
      "source": "./plugins/wooyun-legacy"
    },
    {
      "name": "openai-cloudflare-deploy",
      "version": "1.0.0",
      "description": "Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-cloudflare-deploy"
    },
    {
      "name": "openai-develop-web-game",
      "version": "1.0.0",
      "description": "Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with render_game_to_text. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-develop-web-game"
    },
    {
      "name": "openai-doc",
      "version": "1.0.0",
      "description": "Use when the task involves reading, creating, or editing `.docx` documents, especially when formatting or layout fidelity matters; prefer `python-docx` plus the bundled `scripts/render_docx.py` for visual checks. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-doc"
    },
    {
      "name": "openai-gh-address-comments",
      "version": "1.0.0",
      "description": "Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-gh-address-comments"
    },
    {
      "name": "openai-gh-fix-ci",
      "version": "1.0.0",
      "description": "Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-gh-fix-ci"
    },
    {
      "name": "openai-jupyter-notebook",
      "version": "1.0.0",
      "description": "Use when the user asks to create, scaffold, or edit Jupyter notebooks (`.ipynb`) for experiments, explorations, or tutorials; prefer the bundled templates and run the helper script `new_notebook.py` to generate a clean starting notebook. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-jupyter-notebook"
    },
    {
      "name": "openai-netlify-deploy",
      "version": "1.0.0",
      "description": "Deploy web projects to Netlify using the Netlify CLI (`npx netlify`). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-netlify-deploy"
    },
    {
      "name": "openai-pdf",
      "version": "1.0.0",
      "description": "Use when tasks involve reading, creating, or reviewing PDF files where rendering and layout matter; prefer visual checks by rendering pages (Poppler) and use Python tools such as `reportlab`, `pdfplumber`, and `pypdf` for generation and extraction. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-pdf"
    },
    {
      "name": "openai-playwright",
      "version": "1.0.0",
      "description": "Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-playwright"
    },
    {
      "name": "openai-screenshot",
      "version": "1.0.0",
      "description": "Use when the user explicitly asks for a desktop or system screenshot (full screen, specific app or window, or a pixel region), or when tool-specific capture capabilities are unavailable and an OS-level capture is needed. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-screenshot"
    },
    {
      "name": "openai-security-best-practices",
      "version": "1.0.0",
      "description": "Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-security-best-practices"
    },
    {
      "name": "openai-security-ownership-map",
      "version": "1.0.0",
      "description": "Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-security-ownership-map"
    },
    {
      "name": "openai-security-threat-model",
      "version": "1.0.0",
      "description": "Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-security-threat-model"
    },
    {
      "name": "openai-sentry",
      "version": "1.0.0",
      "description": "Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-sentry"
    },
    {
      "name": "openai-spreadsheet",
      "version": "1.0.0",
      "description": "Use when tasks involve creating, editing, analyzing, or formatting spreadsheets (`.xlsx`, `.csv`, `.tsv`) using Python (`openpyxl`, `pandas`), especially when formulas, references, and formatting need to be preserved and verified. Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-spreadsheet"
    },
    {
      "name": "openai-yeet",
      "version": "1.0.0",
      "description": "Use only when the user explicitly asks to stage, commit, push, and open a GitHub pull request in one flow using the GitHub CLI (`gh`). Originally from OpenAI's curated skills catalog.",
      "author": {
        "name": "OpenAI",
        "url": "https://github.com/openai/skills"
      },
      "source": "./plugins/openai-yeet"
    },
    {
      "name": "ghidra-headless",
      "version": "1.0.0",
      "description": "Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.",
      "author": {
        "name": "Armin Ronacher",
        "url": "https://github.com/mitsuhiko/agent-stuff"
      },
      "source": "./plugins/ghidra-headless"
    },
    {
      "name": "last30days",
      "version": "1.0.0",
      "description": "Researches any topic from the last 30 days across Reddit, X, and the web, surfacing real community discussions with engagement metrics",
      "author": {
        "name": "mvanhorn",
        "url": "https://github.com/mvanhorn/last30days-skill"
      },
      "source": "./plugins/last30days"
    },
    {
      "name": "x-research",
      "version": "1.0.0",
      "description": "Searches X/Twitter for real-time perspectives, dev discussions, product feedback, breaking news, and expert opinions using the X API v2",
      "author": {
        "name": "rohunvora",
        "url": "https://github.com/rohunvora/x-research-skill"
      },
      "source": "./plugins/x-research"
    },
    {
      "name": "scv-scan",
      "version": "1.0.0",
      "description": "Audits Solidity codebases for smart contract vulnerabilities using a four-phase workflow covering 36 vulnerability classes.",
      "author": {
        "name": "kadenzipfel",
        "url": "https://github.com/kadenzipfel/scv-scan"
      },
      "source": "./plugins/scv-scan"
    },
    {
      "name": "react-pdf",
      "version": "1.0.0",
      "description": "Generates PDF documents using React-PDF library (@react-pdf/renderer) with flexbox layout, SVG graphics, custom fonts, and professional typesetting.",
      "author": {
        "name": "molefrog",
        "url": "https://github.com/molefrog/skills"
      },
      "source": "./plugins/react-pdf"
    },
    {
      "name": "python-code-simplifier",
      "version": "1.0.0",
      "description": "Simplifies and refines Python code for clarity, consistency, and maintainability while preserving all functionality.",
      "author": {
        "name": "Anthropic",
        "url": "https://github.com/anthropics/claude-plugins-official"
      },
      "source": "./plugins/python-code-simplifier"
    },
    {
      "name": "security-awareness",
      "version": "1.0.0",
      "description": "Teaches agents to recognize and avoid security threats during normal activity. Covers phishing detection, credential protection, domain verification, and social engineering defense.",
      "author": {
        "name": "1Password",
        "url": "https://github.com/1Password/SCAM"
      },
      "source": "./plugins/security-awareness"
    },
    {
      "name": "productivity",
      "version": "1.0.0",
      "description": "General workflow skills: relentless plan-grilling interviews, conversation handoff documents, multi-session teaching workspaces, and a reference for writing predictable agent skills.",
      "author": {
        "name": "Matt Pocock",
        "url": "https://github.com/mattpocock/skills"
      },
      "source": "./plugins/productivity"
    }
  ]
}