SECURITY / Trail of Bits
Trail of Bits Audit Context Building
Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass.
“Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when”
01 / THE REASONING
Why this made the selection.
- Follows callees and unsuccessful paths instead of trusting names such as validate or authorize.
- Keeps detailed prose on disk and returns compact records, preserving unresolved assumptions for later review.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/audit-context-building/skills/audit-context-building/SKILL.md
- plugins/audit-context-building/skills/audit-context-building/resources/ANALYSIS_FORMAT.md
- plugins/audit-context-building/skills/audit-context-building/resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md
- plugins/audit-context-building/agents/function-analyzer.md
- plugins/audit-context-building/workflows/audit-context.js
- LICENSE
Our findings
- The inspected workflow separates orientation, per-function analysis and synthesis and records functions below its selection cutoff.
- The function analyzer writes prose plus a structured record and requires source lines or explicit open questions.
- The synthesis instructions preserve conflicting records and unenforced assumptions rather than silently resolving them into findings.
Not established by this review
- Source inspection only; no skill installation or workflow execution was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
- Install the complete audit-context-building plugin, including its agents, workflows and references.
- Claude Code: add the trailofbits/skills marketplace with /plugin marketplace add trailofbits/skills, then select the plugin in /plugin menu.
- The publisher also documents Codex marketplace compatibility; confirm the required workflow and delegation capabilities in the chosen host.
Before you start
- A supported Claude Code or Codex plugin host
- Permission for the plugin’s repository reads, outputs and any requested test commands
- Complete plugin and read access to relevant source and callees
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/skills/audit-context-building/SKILL.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, compatibility, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/skills/audit-context-building/resources/ANALYSIS_FORMAT.md
Supports: review, limitations, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/skills/audit-context-building/resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md
Supports: review, limitations, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/agents/function-analyzer.md
Supports: review, limitations, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/workflows/audit-context.js
Supports: review, limitations, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/LICENSE
Supports: license
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/README.md
Supports: install, compatibility, access
https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md
Supports: install