What you get
Audit output arrives as SARIF, so it drops straight into the alerting you already have.
Trail of Bits: 39 Security Plugins
Added 2026-08-06Organised into nine categories — smart-contract security, code audit, malware analysis, verification, reverse engineering, mobile — the 39 plugins hold 77 SKILL.md files, code audit alone accounting for 19.
The C and Rust review skills fan out clustered parallel workers and emit SARIF; false-positive checking is its own skill with a mandatory gate review; vulnerability triage decides accept, reject or more-information through seven brocard-style tests. A Trophy Case records field results and holds exactly one — constant-time analysis finding a timing side channel in RustCrypto's ML-DSA signatures. The catalogue also carries plenty that is not security: personality assessments, MCP troubleshooting, even tarot cards. Licence is CC BY-SA.