New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Audit Context Building

by trailofbits in trailofbits/skills

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

OfficialCC-BY-SA-4.0Auto-check passedSecurity

Install Audit Context Building

skills CLI
$ npx skills add trailofbits/skills --skill audit-context-building -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install trailofbits/skills audit-context-building --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/trailofbits/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/audit-context-building/skills/audit-context-building .claude/skills/audit-context-building && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
audit-context-building
GitHub stars
7.4k
Token cost
~996 tokens
SKILL.md length
565 words
Files
6 (incl. assets)
Skills in repo
79
Repo updated
First seen
Licence
CC-BY-SA-4.0

At a glance

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

  • Starting an audit
  • SKILL.md covers When to Use, When NOT to Use, Do not analyze in this context and What comes back, and how to…, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Architecture review on unfamiliar code

What it does

Audit Context Building is an agent skill from trailofbits/skills, published by the product's own GitHub organization. Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.

Its SKILL.md is about 1000 tokens, which your agent loads only when the skill is triggered. The skill folder holds 8 other files, including assets (for example `agents/openai.yaml`, `resources/ANALYSIS_FORMAT.md` and `resources/DOMAIN_NOTES.md`).

It sits in Security, covering Software architecture, Threat modeling and Bug bounty. The repository describes itself as: Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows. The licence is CC-BY-SA-4.0.

When your agent uses it

  • Starting an audit
  • Architecture review on unfamiliar code
  • Before any vulnerability-hunting pass

Example prompts

  • “/audit-context-building”

Requirements

  • Pre-approved tools (allowed-tools): Workflow, Task, Read, Grep, Glob

What it can do on your machine

Read from SKILL.md and the folder at commit 82fe822. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Workflow
    • Task
    • Read
    • Grep
    • Glob

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Audit Context Building loads about 996 tokens when it runs. Until then it costs about 72 tokens; SKILL.md has 565 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~72
When it runs · the whole SKILL.md, loaded when a task matches
~996

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from trailofbits/skills at commit 82fe822, republished under its CC-BY-SA-4.0 licence (© trailofbits). 565 words, ~996 tokens.

Download SKILL.mdSave it as .claude/skills/audit-context-building/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
audit-context-building
description
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.
allowed-tools
Workflow, Task, Read, Grep, Glob

Audit Context Building

Build understanding, not verdicts. This runs before anyone hunts for bugs, and feeds that work.

When to Use

At the start of an audit, a threat model, or an architecture review, when the code is unfamiliar. Also when an earlier pass produced findings nobody could judge, because no one had mapped out how the system fits together.

When NOT to Use

Do not name vulnerabilities, suggest fixes, write proofs-of-concept, or rate severity. Those belong to the hunting phase, which runs next and with the whole picture in hand. When the code counts on something and nothing checks it, record that plainly and move on — whether it matters is decided later.

Not worth the tokens on code you already understand.

Do not analyze in this context

The analysis is long, and this context needs to survive to use it. Dispatch it:

  • A codebase, or more than one function — run /audit-context-building:audit-context <path>. It orients, analyzes each function in its own subagent, and writes audit-context/DOSSIER.md plus one file per function under audit-context/functions/. Only compact records return here.
  • A single function — dispatch the audit-context-building:function-analyzer agent at it. It writes its prose to disk and returns a record.

Then work from what comes back: the index, the unenforced assumptions, the open questions. Read a function's file when you need its detail.

The workflow is what enforces this, not this text: a subagent bound to a return schema cannot return prose. Treat this section as routing, and route.

What comes back, and how to read it

Each record lists what must always be true (with the line that shows it), what the function takes on faith (with whatever establishes it), which functions it calls and what it needs from each, and anything still unclear. The dossier adds the rules that span several functions, who can reach what, and where the complicated parts cluster.

Two things matter more than the rest:

  • Assumptions marked nothing found. The code counts on something being true and nothing anywhere makes it true. This is the most useful thing to hand the hunting phase.
  • The open questions. An honest list of what is still unclear beats a confident answer that turns out to be wrong. Carry them forward instead of closing them out.

Where two records disagree, both are quoted rather than quietly reconciled. That is a fact about the code, not a flaw in the analysis.

Show full SKILL.md (167 more words)Show less

The format

ANALYSIS_FORMAT.md defines it, and FUNCTION_MICRO_ANALYSIS_EXAMPLE.md works through examples in C and Solidity. Read them when extending this plugin or deciding whether a record can be trusted.

The format is the same whatever the target. What changes is what fills each slot, and what counts as a call you cannot see inside. DOMAIN_NOTES.md maps that across smart contracts, C and C++, decompiled firmware, and web services — read it when the target is not plain source code.

The rule that matters most: follow the calls. Whether a function is correct usually depends on something another function does, and you cannot see that from the caller alone. A limit looks enforced because the value came back from a function whose name suggests it was checked. So read the function being called, follow every path through it rather than only the one that succeeds, and say what makes each assumption true. When nothing does, use those words: nothing found. Every claim cites a line, or becomes an open question.

© trailofbits, CC-BY-SA-4.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (assets) in plugins/audit-context-building/skills/audit-context-building of trailofbits/skills.

  • SKILL.md
  • agents/openai.yaml
  • assets/trail-of-bits-mark.svg
  • resources/ANALYSIS_FORMAT.md
  • resources/DOMAIN_NOTES.md
  • resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md

Open the folder on GitHubat commit 82fe822

Compare with similar skills

Audit Context Building next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Audit Context Building compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Audit Context Building this skilltrailofbits/skills7.4k—~996Automated safety check: PassCC-BY-SA-4.0
Web2 Reconawarexone/Agentic-Bug-Hunter5.3k2 repos~6.4kAutomated safety check: WarnMIT
Osint Methodologyelementalsouls/Claude-OSINT2.8k—~8.7kAutomated safety check: NotesMIT
Security Specialistfabricioctelles/skills106—~2.8kAutomated safety check: PassApache-2.0
Threat Modeling Expertdavila7/claude-code-templates32k8 repos~529Automated safety check: PassMIT
Reconbriiirussell/cybersecurity-skills413—~1.1kAutomated safety check: NotesMIT

Similar skills

  • Web2 Recon

    awarexone/Agentic-Bug-Hunter

    Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis…

    5.3k GitHub starsUsed in 2 repos~6.4k tokens
    SecurityAuto-check: warnings

  • Osint Methodology

    elementalsouls/Claude-OSINT

    Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

    2.8k GitHub stars~8.7k tokensUpdated 1 mo ago
    SecurityAuto-check: notes

  • Security Specialist

    fabricioctelles/skills

    Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

    106 GitHub stars~2.8k tokensUpdated 3 days ago
    SecurityAuto-check passed

  • Threat Modeling Expert

    davila7/claude-code-templates

    Expert in threat modeling methodologies, security architecture review, and risk assessment.

    32k GitHub starsUsed in 8 repos~529 tokens
    SecurityAuto-check passed

  • Recon

    briiirussell/cybersecurity-skills

    Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs.

    413 GitHub stars~1.1k tokensUpdated 4 mo ago
    SecurityAuto-check: notes

  • Reconnaissance

    transilienceai/communitytools

    Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

    562 GitHub stars~1.4k tokensUpdated 2 mo ago
    SecurityAuto-check passed

More from trailofbits/skills

All 79 skills in this repo

  • Code Graph Mermaid Diagrams

    trailofbits/skills

    Official

    Generates Mermaid diagrams from Trailmark code graphs, including call graphs, class hierarchies, module dependency maps, complexity heatmaps and attack surface data flows.

    7.4k GitHub starsUsed in 1 repo~1.7k tokens
    Auto-check passed

  • CodeQL Security Scan

    trailofbits/skills

    Official

    Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.

    7.4k GitHub stars~4.6k tokensUpdated today
    Auto-check: notes

  • Trailmark Graph Evolution

    trailofbits/skills

    Official

    Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

    7.4k GitHub stars~3.4k tokensUpdated today
    Auto-check passed

  • Let Fate Decide

    trailofbits/skills

    Official

    Draws a 12 Houses tarot spread to break ties when a request is vague or casually delegated, then reads the cards to pick the next step.

    7.4k GitHub stars~2.5k tokensUpdated today
    Auto-check: notes

  • Burp Suite Project Parser

    trailofbits/skills

    Official

    Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.

    7.4k GitHub starsUsed in 4 repos~4.2k tokens
    Auto-check: notes

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated today
    Auto-check: notes

Categories

Questions about Audit Context Building

What does Audit Context Building do?

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Audit Context Building is an agent skill from trailofbits/skills, published by the product's own GitHub organization. Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

When should I use Audit Context Building?

Audit Context Building fits situations like: starting an audit; architecture review on unfamiliar code; before any vulnerability-hunting pass.

How do I install Audit Context Building in Claude Code?

Run `npx skills add trailofbits/skills --skill audit-context-building -a claude-code`. Or copy the skill folder (plugins/audit-context-building/skills/audit-context-building in trailofbits/skills) into .claude/skills/audit-context-building in your project. Claude Code loads it when a task matches its description.

How do I install Audit Context Building in Codex?

Run `npx skills add trailofbits/skills --skill audit-context-building -a codex`. Or copy the skill folder (plugins/audit-context-building/skills/audit-context-building in trailofbits/skills) into .agents/skills/audit-context-building in your project. Codex loads it when a task matches its description.

Can I use Audit Context Building in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trailofbits/skills --skill audit-context-building -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/audit-context-building, .gemini/skills/audit-context-building, .github/skills/audit-context-building and .opencode/skills/audit-context-building in your project.

What does Audit Context Building need to run?

SKILL.md names no scripts, command-line tools or credentials: Audit Context Building is instructions for the agent only. Its frontmatter pre-approves these tools: Workflow, Task, Read, Grep, Glob.

Does Audit Context Building access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Audit Context Building safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Audit Context Building use?

Audit Context Building is published under the CC-BY-SA-4.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Audit Context Building use?

About 996 tokens (SKILL.md is roughly 4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Audit Context Building?

Skills that share tags, products or a category with Audit Context Building: Web2 Recon (awarexone/Agentic-Bug-Hunter, 5.3k stars), Osint Methodology (elementalsouls/Claude-OSINT, 2.8k stars), Security Specialist (fabricioctelles/skills, 106 stars) and Threat Modeling Expert (davila7/claude-code-templates, 32k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Audit Context Building?

trailofbits (a GitHub organization, an official publisher) maintains it in trailofbits/skills, which has 7,420 GitHub stars. The repository holds 79 skills in this directory. The repository was last updated on October 7, 2026.

Source: trailofbits/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.