audit-context-building

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, architecture, code-quality, debugging, security.

What it does

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill audit-context-building

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/audit-context-building/skills/audit-context-building ~/.claude/skills/audit-context-building

Safety box score

Grade A, minimal risk: 4 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a local audit-orchestration helper: it reads code, delegates analysis to subagents, and writes audit artifacts under `audit-context/` in the working tree. It does not include shell commands, downloads, secret handling, or external actions, so the main blast radius is limited to local analysis files and workflow noise.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell commands, code evaluation, or native scripts are shipped; the only tools listed are `Workflow Task`, `Read`, `Grep`, and `Glob`.
Network access	0 (none)	There are no URL fetches, API calls, or remote upload steps in `SKILL.md` or the shipped resources.
Filesystem reach	1 (low)	The skill explicitly says it writes `audit-context/DOSSIER.md` plus one file per function under `audit-context/functions/`, which is a bounded write inside the repo.
Secrets & credentials	0 (none)	Nothing in the skill reads credential stores, `.env` files, keychains, browser sessions, or asks the user to paste secrets.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, or shell/OS configuration change.
Instruction hijack surface	0 (none)	The text is strongly directive, but it does not ask the agent to ignore safeguards, hide actions, or follow remote instructions.
Irreversible actions	0 (none)	It does not send messages, deploy, publish, pay, book, or delete anything; it only organizes local analysis work.
Transparency	0 (none)	All shipped files are human-readable markdown, YAML, and SVG; there are no binaries, installers, or decoded-at-runtime blobs.

Before installing

Decide whether you want `audit-context/` generated in this repo and whether it should be gitignored.
Run it once in a scratch copy if you want to inspect the generated dossier structure before using it on a real working tree.
Confirm the skill only uses `Workflow Task`, `Read`, `Grep`, and `Glob` and does not ship any scripts or network fetches.

Rated 2026-10-19 by an automated review of 6 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/audit-context-building/skills/audit-context-building/SKILL.md
Branch: main
Collection: audit-context-building
Updated: 2026-09-19

c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
differential-review — Performs security-focused differential review of code changes.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.