{ "$schema": "https://readbeforerun.ai/schema/entry.schema.json", "entry": { "id": "trailofbits-static-analysis", "name": "Trail of Bits Static Analysis", "summary": "Claude Code plugin that drives CodeQL, Semgrep and SARIF parsing to find security vulnerabilities in a codebase.", "draft": "review", "type": "plugin", "mission": [ "defensive" ], "task": [ "code-review-sast" ], "domain": [ "application-security" ], "runtime": [ "claude-code", "codex" ], "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "in_my_kit": null, "advice": null, "code_shows": "writes outside the project · talks to any host · runs shell commands or eval · changes config or installs globally · has broad pre-approvals · Secrets: unknown", "source": { "repo": "https://github.com/trailofbits/skills", "subpath": "plugins/static-analysis", "commit": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "version": "1.5.0", "license": "CC-BY-SA-4.0" }, "install": { "skills_cli": null, "claude_code": null, "upstream": "/plugin marketplace add trailofbits/skills\n/plugin menu", "bundled": false }, "scan": { "status": "static scan pending (not run)" }, "reach": { "method": "reach-v0.1", "level": 2, "level_source": "static", "level_label": "open", "unknown_axes": 1, "verdict": "not-run", "badge": "reach ≥2 · not run yet", "long": "reach ≥2 from code (open, 1 right unknown); lab: not run yet", "declared": { "fs": 1, "net": 1, "exec": 2, "hitl": 2 }, "static": { "level": 2, "fs": 2, "net": 2, "exec": 2, "cred": null, "persist": 2, "hitl": 2, "unknown": [ "cred" ] }, "observed": null, "surplus": null, "fit": null, "exports": { "aivss": { "fs": 0.5, "net": 0.5, "exec": 0.5, "cred": null, "persist": 0.5, "hitl": 0.5 }, "usf_risk_tier": "L2" } }, "profile": { "read_at": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "read_on": "2026-10-25", "overview": "A static analysis toolkit plugin with CodeQL, Semgrep and SARIF parsing for security vulnerability detection.", "purpose": [ "Detects security vulnerabilities in codebases.", "Runs CodeQL for interprocedural taint tracking and data flow analysis, and Semgrep for pattern-based bug detection.", "Parses SARIF output and aggregates and deduplicates findings from several tools." ], "use_cases": [ { "text": "Scan a repository with CodeQL: build the database, create data extensions, then run the analysis.", "task": "code-review-sast" }, { "text": "Run a Semgrep security audit of a codebase, or find vulnerabilities before code review.", "task": "code-review-sast" }, { "text": "Read, aggregate and deduplicate SARIF findings from several security scanners.", "task": "code-review-sast" }, { "text": "Build a CodeQL database when the build is the long, uncertain part and should be driven to a conclusion.", "task": "code-review-sast" } ], "maturity": null, "capabilities": [ { "name": "codeql", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default" }, { "name": "semgrep", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default" }, { "name": "sarif-parsing", "effects": [ "reads", "runs-commands" ], "enabled": "default" }, { "name": "/static-analysis:semgrep-scan", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default" }, { "name": "/static-analysis:codeql-build", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default" } ], "effects": [ "reads", "changes", "deletes", "runs-commands" ], "runs": "in-client", "listens": [], "sends_to": [ { "to": "Semgrep registry", "kind": "download", "when": "default" }, { "to": "Third-party Semgrep rule repositories", "kind": "download", "when": "default" }, { "to": "CodeQL pack registry", "kind": "download", "when": "optional" }, { "to": "Target project's package registries", "kind": "download", "when": "optional" }, { "to": "Homebrew", "kind": "download", "when": "optional" } ], "model": "client", "needs": [ { "kind": "runtime", "text": "Ships as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility." }, { "kind": "tools", "text": "The CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle)." }, { "kind": "tools", "text": "The CodeQL skill also requires jq and uv on PATH." }, { "kind": "tools", "text": "The Semgrep skill requires the Semgrep CLI." }, { "kind": "tools", "text": "For C/C++, Java/Kotlin, C# and Rust, complete extraction needs a build CodeQL can trace; --build-mode=none gives partial analysis." }, { "kind": "runtime", "text": "The codeql skill's two Python scripts declare Python 3.11 or later and run standalone under uv run." }, { "kind": "account", "text": "Semgrep Pro is optional; it enables cross-file taint tracking, inter-procedural analysis and Apex, C# and Elixir." }, { "kind": "credentials", "text": "When the target's dependencies come from a private registry, the CodeQL build-fix step asks the user to configure registry authentication and retry, or to skip them." } ] }, "urls": { "page": "/catalog/trailofbits-static-analysis/", "json": "/entries/trailofbits-static-analysis.json", "md": "/catalog/trailofbits-static-analysis.md", "badge": "/badge/trailofbits-static-analysis.svg" } }, "data": { "schema_version": "0.5", "slug": "trailofbits-static-analysis", "name": "Trail of Bits Static Analysis", "summary": "Claude Code plugin that drives CodeQL, Semgrep and SARIF parsing to find security vulnerabilities in a codebase.", "draft": "review", "in_my_kit": null, "type": "plugin", "mission": [ "defensive" ], "task": [ "code-review-sast" ], "domain": [ "application-security" ], "phase": [ "def:protect" ], "role": [ "appsec" ], "runtime": [ "claude-code", "codex" ], "auth": null, "autonomy": null, "addresses": [], "frameworks": { "owasp_ast": [], "owasp_asi": [], "attack_tactic": [], "atlas": [] }, "source": { "repo": "https://github.com/trailofbits/skills", "subpath": "plugins/static-analysis", "commit": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "version": "1.5.0", "license": "CC-BY-SA-4.0", "manifest": "plugin.json", "also_listed": {} }, "upstream": { "checked_at": "2026-10-19", "updated_at": "2026-10-15", "current_release": null, "archived": false, "stars": 7640, "commit_history": {}, "releases_since_pin": 0 }, "install": { "upstream": "/plugin marketplace add trailofbits/skills\n/plugin menu", "upstream_evidence": "README.md#L12-18", "bundled": false }, "scan": [ { "tool": "cisco-skill-scanner", "version": "not-run", "llm_judge": false, "date": "2026-10-19", "result": "pending" } ], "privileges": { "method": "reach-v0.1", "declared": { "axes": { "fs": 1, "net": 1, "exec": 2, "hitl": 2 }, "evidence": { "fs": "plugins/static-analysis/skills/codeql/SKILL.md#L51 author keeps all generated files in one output directory", "net": "plugins/static-analysis/README.md#L79 author declares that run-scans.sh clones the third-party rule repositories", "exec": "plugins/static-analysis/skills/codeql/SKILL.md#L13 frontmatter pre-approves Bash with no command pattern", "hitl": "plugins/static-analysis/skills/codeql/SKILL.md#L13 frontmatter pre-approves unscoped Bash plus Write and Edit" } }, "static": { "level": 2, "axes": { "fs": 2, "net": 2, "exec": 2, "cred": null, "persist": 2, "hitl": 2 }, "evidence": { "fs": "plugins/static-analysis/skills/codeql/references/extension-yaml-format.md#L165 copies generated data-extension YAML into the CodeQL pack cache outside the working directory", "net": "plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L409 shallow-clones every third-party rule URL, and L281 accepts any https host", "exec": "plugins/static-analysis/skills/codeql/references/build-fixes.md#L54 installs the target project's dependencies and runs its build", "cred": "no evidence: the plugin's own scripts show no credential or environment access; the pattern scan matched only the repo-root marketplace keyword list, not plugins/static-analysis", "persist": "plugins/static-analysis/skills/sarif-parsing/SKILL.md#L381 suggests a global npm install for SARIF validation", "hitl": "plugins/static-analysis/skills/codeql/SKILL.md#L13 frontmatter pre-approves unscoped Bash plus Write and Edit, which equals broad pre-approval" }, "unknown": [ "cred" ] }, "min_config": { "status": "derived", "claude_code": "run only against code you trust; keep the Semgrep ruleset-approval gate on and review the cloned third-party rule repos before scanning", "codex": "sandbox_mode=workspace-write; allow outbound only to the rule repositories listed in references/rulesets.md", "note": "derived from the code, not tested in the lab" }, "override": null, "reviews": [] }, "status": { "tier": "listed", "last_checked": "2026-10-19", "next_check": "2027-01-17", "freshness": "fresh", "superseded": false, "superseded_by": null, "added": "2026-10-19", "added_by": "scout" }, "evidence": { "runs": [], "badge": "/badge/trailofbits-static-analysis.svg" }, "changes": [] }, "profile": { "schema_version": "0.1", "entry": "trailofbits-static-analysis", "draft": "review", "commit": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "read_on": "2026-10-25", "check": { "date": "2026-10-25", "facts": 56, "confirmed": 56, "verified": 50 }, "overview": { "text": "A static analysis toolkit plugin with CodeQL, Semgrep and SARIF parsing for security vulnerability detection.", "ev": "plugins/static-analysis/.claude-plugin/plugin.json#L4 plugin manifest description" }, "purpose": [ { "text": "Detects security vulnerabilities in codebases.", "ev": "plugins/static-analysis/README.md#L23 When to Use list" }, { "text": "Runs CodeQL for interprocedural taint tracking and data flow analysis, and Semgrep for pattern-based bug detection.", "ev": "plugins/static-analysis/README.md#L24-25 When to Use list" }, { "text": "Parses SARIF output and aggregates and deduplicates findings from several tools.", "ev": "plugins/static-analysis/README.md#L26-27 When to Use list" } ], "use_cases": [ { "text": "Scan a repository with CodeQL: build the database, create data extensions, then run the analysis.", "task": "code-review-sast", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L170 Quick Start pipeline" }, { "text": "Run a Semgrep security audit of a codebase, or find vulnerabilities before code review.", "task": "code-review-sast", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L32-33 When to Use" }, { "text": "Read, aggregate and deduplicate SARIF findings from several security scanners.", "task": "code-review-sast", "ev": "plugins/static-analysis/skills/sarif-parsing/SKILL.md#L18-20 When to Use" }, { "text": "Build a CodeQL database when the build is the long, uncertain part and should be driven to a conclusion.", "task": "code-review-sast", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L218-220 when to use codeql-build" } ], "not_for": [ { "text": "The semgrep skill is not meant for binary analysis.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L39 When NOT to Use" }, { "text": "The sarif-parsing skill does not run scans; it processes existing SARIF results.", "ev": "plugins/static-analysis/skills/sarif-parsing/SKILL.md#L28 When NOT to Use" }, { "text": "The semgrep skill points projects that already run Semgrep in CI to their existing pipeline.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L40 When NOT to Use" } ], "capabilities": { "coverage": "complete", "groups": [ { "name": "codeql", "does": "Deep security analysis with taint tracking and data flow.", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default", "ev": "plugins/static-analysis/README.md#L16 Skills Included table" }, { "name": "semgrep", "does": "Pattern-based security scanning with Semgrep.", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default", "ev": "plugins/static-analysis/README.md#L17 Skills Included table" }, { "name": "sarif-parsing", "does": "Parses and processes results from static analysis tools.", "effects": [ "reads", "runs-commands" ], "enabled": "default", "ev": "plugins/static-analysis/README.md#L18 Skills Included table" }, { "name": "/static-analysis:semgrep-scan", "does": "Workflow shipped as /static-analysis:semgrep-scan with four phases: Detect, Select, Scan, Report.", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default", "ev": "plugins/static-analysis/README.md#L72 Workflows Included table" }, { "name": "/static-analysis:codeql-build", "does": "/static-analysis:codeql-build walks the build-method ladder (autobuild, custom command, multi-step, no-build), retrying at each rung, then enforces the quality gate.", "effects": [ "reads", "changes", "deletes", "runs-commands" ], "enabled": "default", "ev": "plugins/static-analysis/README.md#L73 Workflows Included table" } ] }, "architecture": { "summary": { "text": "The semgrep-scan workflow's Scan phase calls run-scans.sh; exit codes come from the semgrep processes and finding counts from the JSON they wrote.", "ev": "plugins/static-analysis/README.md#L86-88 how the scan phase runs" }, "runs": { "where": "in-client", "text": "Runs inside the AI client as skill instructions; the codeql skill lists Bash, Read, Write and Edit among its allowed-tools.", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L13 allowed-tools frontmatter" }, "modes": [ { "where": "in-client", "mode": "unattended Semgrep scan", "switch": "/static-analysis:semgrep-scan", "text": "The semgrep-scan workflow runs the whole Semgrep scan without the ruleset approval gate that the semgrep skill enforces.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L167-171 workflow skips approval" }, { "where": "in-client", "mode": "unattended CodeQL build", "switch": "/static-analysis:codeql-build", "text": "The codeql-build workflow builds the database without asking and returns statuses such as no-method-succeeded or built-below-threshold.", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L213-216 unattended build" } ], "parts": [ { "name": "Skills: codeql, semgrep, sarif-parsing", "zone": "client", "does": "SKILL.md files with reference and workflow documents that the client model follows step by step.", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L20 skill resources" }, { "name": "Workflows: semgrep-scan.js, codeql-build.js", "zone": "client", "does": "Plugin workflow script shipped as /static-analysis:semgrep-scan, namespaced by the plugin's name field.", "ev": "plugins/static-analysis/workflows/semgrep-scan.js#L1-3 workflow header" }, { "name": "Bundled bash and Python scripts", "zone": "machine", "does": "run-scans.sh runs the selected Semgrep rulesets, generates every semgrep command, and reports what each scan produced.", "ev": "plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L2-4 script purpose" }, { "name": "CodeQL CLI", "zone": "machine", "does": "The codeql CLI on PATH; the skill stops if it is missing and names gh-codeql, the Homebrew cask or codeql-bundle as install routes.", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L141-147 codeql preflight" }, { "name": "Semgrep CLI", "zone": "machine", "does": "Semgrep CLI, required and checked with semgrep --version.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L89 prerequisite" }, { "name": "Third-party Semgrep rule repositories", "zone": "outside", "does": "Git repositories with Semgrep rules that run-scans.sh shallow-clones into the output directory at scan time.", "ev": "plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L409 git clone of each third-party URL" } ], "listens": [], "connections": [ { "to": "Semgrep registry", "kind": "download", "when": "default", "what": "semgrep resolves p/ ruleset identifiers such as p/default against the Semgrep registry when it runs.", "ev": "plugins/static-analysis/skills/semgrep/workflows/scan-workflow.md#L73-76 registry resolution" }, { "to": "Third-party Semgrep rule repositories", "kind": "download", "when": "default", "what": "run-scans.sh shallow-clones each third-party rule repository URL with git clone --depth 1.", "ev": "plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L409 clone call" }, { "to": "CodeQL pack registry", "kind": "download", "when": "optional", "what": "Trail of Bits CodeQL query packs (cpp, go, java) are fetched with codeql pack download.", "ev": "plugins/static-analysis/skills/codeql/references/ruleset-catalog.md#L27-31 pack install" }, { "to": "Target project's package registries", "kind": "download", "when": "optional", "what": "When a build fails, the fix catalog installs the target project's dependencies with its own package manager.", "ev": "plugins/static-analysis/skills/codeql/references/build-fixes.md#L35 dependency install note" }, { "to": "Homebrew", "kind": "download", "when": "optional", "what": "After the user picks the option, the macOS arm64e path installs llvm and make with Homebrew before retrying the build.", "ev": "plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md#L178-186 brew install" } ], "model": { "who": "client", "text": "The client's model follows the skill instructions; the workflows hand each phase to a client agent.", "ev": "plugins/static-analysis/workflows/semgrep-scan.js#L219 agent call for Detect phase" } }, "needs": [ { "kind": "runtime", "text": "Ships as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility.", "ev": "README.md#L3 marketplace description" }, { "kind": "tools", "text": "The CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle).", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L141-147 codeql preflight" }, { "kind": "tools", "text": "The CodeQL skill also requires jq and uv on PATH.", "ev": "plugins/static-analysis/skills/codeql/SKILL.md#L151-160 jq and uv preflight" }, { "kind": "tools", "text": "The Semgrep skill requires the Semgrep CLI.", "ev": "plugins/static-analysis/skills/semgrep/workflows/scan-workflow.md#L68-71 semgrep check" }, { "kind": "tools", "text": "For C/C++, Java/Kotlin, C# and Rust, complete extraction needs a build CodeQL can trace; --build-mode=none gives partial analysis.", "ev": "plugins/static-analysis/skills/codeql/workflows/build-database.md#L23-26 compiled languages" }, { "kind": "runtime", "text": "The codeql skill's two Python scripts declare Python 3.11 or later and run standalone under uv run.", "ev": "plugins/static-analysis/skills/codeql/scripts/pyproject.toml#L4-10 script runtime" }, { "kind": "account", "text": "Semgrep Pro is optional; it enables cross-file taint tracking, inter-procedural analysis and Apex, C# and Elixir.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L91 optional Pro" }, { "kind": "credentials", "text": "When the target's dependencies come from a private registry, the CodeQL build-fix step asks the user to configure registry authentication and retry, or to skip them.", "ev": "plugins/static-analysis/skills/codeql/references/build-fixes.md#L84-92 private registry handling" } ], "installer": [ { "text": "Claude Code: add the trailofbits/skills marketplace with /plugin marketplace add, then pick the plugin from /plugin menu.", "ev": "README.md#L11-18 marketplace install" }, { "text": "The plugin README gives a one-line install by repository path: /plugin install trailofbits/skills/plugins/static-analysis.", "ev": "plugins/static-analysis/README.md#L102 plugin install line" }, { "text": "Codex: codex plugin marketplace add trailofbits/skills, then codex plugin add @trailofbits.", "ev": "README.md#L27-31 Codex install" } ], "limits": [ { "text": "To fix a failed CodeQL build, the skill installs the target project's dependencies (pip install -r requirements.txt, pip install -e ., npm install).", "ev": "plugins/static-analysis/skills/codeql/references/build-fixes.md#L45-54 dependency install block" }, { "text": "For compiled languages the CodeQL build methods run the target project's own build (autobuild, custom command, multi-step tracing).", "ev": "plugins/static-analysis/skills/codeql/workflows/build-database.md#L27-32 build ladder" }, { "text": "run-scans.sh accepts third_party entries that match an https URL pattern allowing any host name and port, and exits otherwise.", "ev": "plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L279-282 third_party URL check" }, { "text": "Semgrep OSS mode cannot track data flow across files; cross-file analysis needs Semgrep Pro.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L105 limitations" }, { "text": "Semgrep sends telemetry by default and --config auto also phones home, so the skill requires --metrics=off on every semgrep command.", "ev": "plugins/static-analysis/skills/semgrep/SKILL.md#L23 principle 1" }, { "text": "The build-fix catalog cleans build state in the target project (make clean, rm -rf build CMakeCache.txt CMakeFiles, gradlew, mvn and cargo clean).", "ev": "plugins/static-analysis/skills/codeql/references/build-fixes.md#L23-30 clean build cache" }, { "text": "As a workaround for pre-compiled packs, the CodeQL skill copies generated data extension YAML into the ext/ directory inside CodeQL's managed pack cache.", "ev": "plugins/static-analysis/skills/codeql/references/extension-yaml-format.md#L154-156 deploying extensions" }, { "text": "To locate run-scans.sh, the semgrep-scan workflow checks the plugin root and plugin cache and, as a fallback, searches the home directory to depth 9.", "ev": "plugins/static-analysis/workflows/semgrep-scan.js#L203-212 skill directory search" }, { "text": "If the user picks the Rosetta option on an affected Apple Silicon Mac, the CodeQL skill runs softwareupdate --install-rosetta --agree-to-license before retrying the build.", "ev": "plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md#L190-198 Rosetta install after the user's choice" }, { "text": "As a database quality improvement, the CodeQL skill pip-installs the type stubs types-requests, types-PyYAML and types-redis into the target project's environment.", "ev": "plugins/static-analysis/skills/codeql/references/quality-assessment.md#L163-170 stub install loop" }, { "text": "The sarif-parsing skill's schema validation example installs ajv-cli globally with npm install -g.", "ev": "plugins/static-analysis/skills/sarif-parsing/SKILL.md#L379-382 schema validation block" }, { "text": "The semgrep-scan workflow scans the current working directory when no target is given, and by default creates its output directory beside the target.", "ev": "plugins/static-analysis/workflows/semgrep-scan.js#L9 whenToUse defaults" }, { "text": "The Semgrep ruleset selection adds third-party rule repositories (Trail of Bits, 0xdea, Decurity and others) automatically whenever the language matches and marks them as not optional.", "ev": "plugins/static-analysis/skills/semgrep/references/rulesets.md#L122-130 Step 4 third-party rulesets table" } ], "not_found": [ { "field": "maturity", "searched": "plugins/static-analysis/.claude-plugin/plugin.json, .claude-plugin/marketplace.json, README.md, plugins/static-analysis/README.md, all three SKILL.md files for preview/alpha/beta/experimental/stable/d" }, { "field": "capability_count", "searched": "plugins/static-analysis/README.md and the three SKILL.md files for an author-stated total of skills, commands or tools for the plugin" }, { "field": "listen", "searched": "run-scans.sh, merge_sarif.py, check_db_quality.py, generate_suite.sh, semgrep-scan.js, codeql-build.js and the SKILL.md files for listen/port/bind/server" }, { "field": "autonomy", "searched": "entry type is plugin, not agent; field not applicable" } ] }, "verdict": null, "runs": [] }