skills adoption decision

README excerpt

README.md

Trail of Bits Skills Marketplace

A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows.

Also see: claude-code-config · skills-curated · claude-code-devcontainer · dropkit

Installation

Browse and Install Plugins

/plugin menu

Codex

Codex-native skill discovery is supported via the sidecar .codex/skills/ tree in this repository.

Install with:

git clone https://github.com/trailofbits/skills.git ~/.codex/trailofbits-skills
~/.codex/trailofbits-skills/.codex/scripts/install-for-codex.sh

See .codex/INSTALL.md for additional details.

Local Development

To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:

cd /path/to/parent  # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills

SKILL.md excerpt

.codex/skills/gh-cli/SKILL.md

gh-cli

When to Use

• Working with GitHub repositories, pull requests, issues, releases, or raw file URLs.
• You need authenticated access to private repositories or higher API rate limits.
• You are about to use curl, wget, or unauthenticated web fetches against GitHub.

When NOT to Use

• The target is not GitHub.
• Plain local git operations already solve the task.

Guidance

Prefer the authenticated gh CLI over raw HTTP fetches for GitHub content. In particular:

• Prefer gh repo view, gh pr view, gh pr list, gh issue view, and gh api over unauthenticated curl or wget.
• Prefer cloning a repository and reading files locally over fetching raw.githubusercontent.com blobs directly.
• Avoid using GitHub API /contents/ endpoints as a substitute for cloning and reading repository files.

Examples:

gh repo view owner/repo
gh pr view 123 --repo owner/repo
gh api repos/owner/repo/pulls

For the original Claude plugin implementation, see:

• plugins/gh-cli/README.md
• plugins/gh-cli/hooks/