ReadBeforeRunAgentic Security Field Guide

Catalog / Plugin

Trail of Bits Static Analysis

Draft · awaiting review

Claude Code plugin that drives CodeQL, Semgrep and SARIF parsing to find security vulnerabilities in a codebase.

For Code review and static analysis (SAST)Works with Claude Code, CodexMaintained trailofbits, last push 2026-10-15

PluginA plugin bundles skills, commands, hooks or MCP servers for one AI client. by trailofbits · read from the code at 5c99c03 (1.5.0) on 2026-10-19The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

  1. Files. Copies generated data-extension YAML into the CodeQL pack cache outside the working directory.

    extension-yaml-format.md L165

  2. Network. Shallow-clones every third-party rule URL, and L281 accepts any https host.

    run-scans.sh L409

  3. Execution. Installs the target project's dependencies and runs its build.

    build-fixes.md L54

  4. Persistence. Suggests a global npm install for SARIF validation.

    SKILL.md L381

  5. Approval. Frontmatter pre-approves unscoped Bash plus Write and Edit, which equals broad pre-approval.

    SKILL.md L13

  6. Secrets. Unknown: the plugin's own scripts show no credential or environment access; the pattern scan matched only the repo-root marketplace keyword list, not plugins/static-analysis. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

  1. Claude Code: run only against code you trust; keep the Semgrep ruleset-approval gate on and review the cloned third-party rule repos before scanning.
  2. Codex: sandbox_mode=workspace-write; allow outbound only to the rule repositories listed in references/rulesets.md.

What we checked, and what we foundDisagree?

Plugin · code showsreach ≥2 · open
222?22FilesNetworkExecutionSecretsPersistenceApproval

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for
  • Detects security vulnerabilities in codebases.
  • Runs CodeQL for interprocedural taint tracking and data flow analysis, and Semgrep for pattern-based bug detection.
  • Parses SARIF output and aggregates and deduplicates findings from several tools.
Use it when
Not for
  • The semgrep skill is not meant for binary analysis.
  • The sarif-parsing skill does not run scans; it processes existing SARIF results.
  • The semgrep skill points projects that already run Semgrep in CI to their existing pipeline.
You need
  • Ships as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility
  • The CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle)
  • The CodeQL skill also requires jq and uv on PATH

+5 more

Details

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

/plugin marketplace add trailofbits/skills /plugin menu
Quoted from README.md#L12-18 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

claude code
run only against code you trust; keep the Semgrep ruleset-approval gate on and review the cloned third-party rule repos before scanning
codex
sandbox_mode=workspace-write; allow outbound only to the rule repositories listed in references/rulesets.md
note
derived from the code, not tested in the lab

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.MarkdownJSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit 5c99c03 on 2026-10-25: 56 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, deletes, runs commands, according to the capabilities read.

GroupWhat it coversEffectOn by default
codeqlDeep security analysis with taint tracking and data flow. README.md L16reads, changes, deletes, runs commandsyes
semgrepPattern-based security scanning with Semgrep. README.md L17reads, changes, deletes, runs commandsyes
/static-analysis:semgrep-scanWorkflow shipped as /static-analysis:semgrep-scan with four phases: Detect, Select, Scan, Report. README.md L72reads, changes, deletes, runs commandsyes
/static-analysis:codeql-build/static-analysis:codeql-build walks the build-method ladder (autobuild, custom command, multi-step, no-build), retrying at each rung, then enforces the quality gate. README.md L73reads, changes, deletes, runs commandsyes
sarif-parsingParses and processes results from static analysis tools. README.md L18reads, runs commandsyes

Where it sends data and who can connect to it

5 outside connections found in the files read: Semgrep registry, Third-party Semgrep rule repositories, CodeQL pack registry, Target project's package registries, Homebrew.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

The semgrep-scan workflow's Scan phase calls run-scans.sh; exit codes come from the semgrep processes and finding counts from the JSON they wrote. README.md L86-88

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

Your machine

Programs and files on the machine where you run the tool.

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 2 (open), one right unknown, read from the code. Not run in our lab yet.

RightAuthor sayswhat the author saysCode showswhat static analysis findsRun showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

  • Files · 1SKILL.md L51 author keeps all generated files in one output directory
  • Network · 1README.md L79 author declares that run-scans.sh clones the third-party rule repositories
  • Execution · 2SKILL.md L13 frontmatter pre-approves Bash with no command pattern
  • Approval · 2SKILL.md L13 frontmatter pre-approves unscoped Bash plus Write and Edit

Code shows: the evidence

  • Files · 2extension-yaml-format.md L165 copies generated data-extension YAML into the CodeQL pack cache outside the working directory
  • Network · 2run-scans.sh L409 shallow-clones every third-party rule URL, and L281 accepts any https host
  • Execution · 2build-fixes.md L54 installs the target project's dependencies and runs its build
  • Secrets · ?no evidence: the plugin's own scripts show no credential or environment access; the pattern scan matched only the repo-root marketplace keyword list, not plugins/static-analysis
  • Persistence · 2SKILL.md L381 suggests a global npm install for SARIF validation
  • Approval · 2SKILL.md L13 frontmatter pre-approves unscoped Bash plus Write and Edit, which equals broad pre-approval

Valid for commit 5c99c03 (1.5.0) · checked 2026-10-19 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

What you need and what the documented installer does

KindWhat
AI clientClaude Code, Codex
RuntimeShips as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility. README.md L3
Other toolsThe CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle). SKILL.md L141-147
Other toolsThe CodeQL skill also requires jq and uv on PATH. SKILL.md L151-160
Other toolsThe Semgrep skill requires the Semgrep CLI. scan-workflow.md L68-71
Other toolsFor C/C++, Java/Kotlin, C# and Rust, complete extraction needs a build CodeQL can trace; --build-mode=none gives partial analysis. build-database.md L23-26
RuntimeThe codeql skill's two Python scripts declare Python 3.11 or later and run standalone under uv run. pyproject.toml L4-10
AccountSemgrep Pro is optional; it enables cross-file taint tracking, inter-procedural analysis and Apex, C# and Elixir. SKILL.md L91
CredentialsWhen the target's dependencies come from a private registry, the CodeQL build-fix step asks the user to configure registry authentication and retry, or to skip them. build-fixes.md L84-92

What the documented installer does

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type
Plugin · Defensive · works with Claude Code, Codex
Source
github.com/trailofbits/skills · plugins/static-analysis · CC-BY-SA-4.0 · manifest plugin.json
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.
5c99c03 · 1.5.0 · last upstream push 2026-10-15 · no release since the pinned commit
In the catalog
listed · added 2026-10-19 · last checked 2026-10-19 · next check 2027-01-17 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.
cisco-skill-scanner: not run, pending
Changes
none since the entry was added on 2026-10-19
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.
v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdownas JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit 5c99c03, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit 5c99c03 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (56 of 56), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Trail of Bits Static Analysis". Agentic Security Field Guide, checked 2026-10-19, method reach-v0.1. https://readbeforerun.ai/catalog/trailofbits-static-analysis/

The method · the rules

For maintainers

Badge for your README (reach ≥2 · not run yet):

[![reach ≥2 · not run yet](https://readbeforerun.ai/badge/trailofbits-static-analysis.svg)](https://readbeforerun.ai/catalog/trailofbits-static-analysis/)

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

Claim the entry with a fieldguide.yaml in your repository: planned.

Other tools for the same task

Task: Code review and static analysis (SAST). The task pages compare every tool side by side.
  1. 202210
    Cloudflare Security Audit SkillSkill · by cloudflare · reach 2, openDraft · awaiting review

    Agent skill that runs a multi-phase, source-first security audit of a codebase and verifies each candidate finding.

    Can write outside the project · run shell commands or eval · read broad tokens or the environment · not run yet · checked 2026-10-19

    Code shows
  2. 012102
    Trail of Bits Agentic Actions AuditorPlugin · by trailofbits · reach 2, openDraft · awaiting review

    Claude Code plugin that statically audits GitHub Actions workflows which invoke AI coding agents for injection and permission flaws.

    Can run shell commands or eval · run with broad pre-approvals · not run yet · checked 2026-10-19

    Code shows