Workflow Skill Reviewer
Reviews workflow-based Claude Code skills for structural quality, pattern adherence, tool assignment correctness, and anti-pattern…
- Type
- Subagent
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
- Source file
- README.md
What Workflow Skill Reviewer is
Workflow Skill Reviewer is a subagent published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Workflow Skill Reviewer and get back a compact result.
How to install Workflow Skill Reviewer
Claude Code
- Download README.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from README.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
> Also see: claude-code-config · codex-config · skills-curated · claude-code-devcontainer · dropkit · coop
Installation
Claude Code Marketplace
/plugin marketplace add trailofbits/skillsBrowse and Install Plugins
/plugin menuCodex
Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata.
Install the marketplace with:
codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbitsChatGPT Workspace Marketplace
Use this repository's .claude-plugin/marketplace.json for workspace imports. Skills that include agents/openai.yaml also need interface.display_name and interface.short_description in that YAML file; plugin metadata does not supply them. After a metadata fix is published, sync the repository again in your workspace marketplace to retry failed imports.
Local Development
To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:
cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skillsAvailable Plugins
Smart Contract Security
Code Auditing
Malware Analysis
Verification
Reverse Engineering
Mobile Security
Development
Team Management
Tooling
Trophy Case
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
When reporting bugs you've found, feel free to mention: > Found using Trail of Bits Skills
Contributing
We welcome contributions! See AGENTS.md for skill authoring guidelines, and run make check before you push — it runs most of CI locally (see AGENTS.md for what it does not cover).
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Workflow Skill Reviewer?
Workflow Skill Reviewer is a subagent for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Reviews workflow-based Claude Code skills for structural quality, pattern adherence, tool assignment correctness, and anti-pattern…
How do I install Workflow Skill Reviewer in Claude Code?
Download README.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Workflow Skill Reviewer in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Workflow Skill Reviewer safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- 5b Poc Validator Compiles and runs all PoCs for zeroize-audit findings. Produces poc_validation_results.json consumed by the verification agent and the orchestrator. Subagent · trailofbits/skills
- 5c Poc Verifier Verifies that each zeroize-audit PoC actually proves the vulnerability it claims to demonstrate. Reads PoC source code, finding details, and original source to check alignment between the PoC and the finding. Produces poc_verification.json consumed by the orchestrator. Subagent · trailofbits/skills
- Adversarial Modeler Models attacker perspectives and builds exploit scenarios for HIGH RISK code changes. Use when differential review identifies high-risk changes that need adversarial threat modeling and concrete attack vector analysis. Subagent · trailofbits/skills
- 5 Poc Generator Crafts bespoke proof-of-concept programs demonstrating that zeroize-audit findings are exploitable. Reads source code and finding details to generate tailored PoCs — each PoC is individually written, not templated. Each PoC exits 0 if the secret persists or 1 if wiped. Mandatory for every finding. Subagent · trailofbits/skills
- Get Current Datetime Execute date command and return ONLY the raw output. No formatting, headers, explanations, or parallel agents. Subagent · UfoMiao/zcf
- Spec Compliance Checker Checks one documented requirement against the code that should implement it, and returns a verdict with the lines that evidence it. Writes its analysis to disk and returns a compact record. Use for a single requirement; use the spec-compliance workflow for a whole document. Subagent · trailofbits/skills
- Zcf Config Architect Advanced configuration management and backup system architect for ZCF project Subagent · UfoMiao/zcf
- Sharp Edges Analyzer Evaluates APIs, configurations, and library interfaces for misuse resistance and footgun potential. Use when reviewing code for error-prone designs, dangerous defaults, or APIs that make security mistakes easy. Subagent · trailofbits/skills