--- title: "Trail of Bits Audit Context Building: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-audit-context-building/ description: "Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass." --- # Trail of Bits Audit Context Building: review, setup & limitations · Undominated.ai > Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass. [← Explore all skills](/skills/) SECURITY / Trail of Bits # Trail of Bits Audit Context Building Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass. See setup guidance ↓Original source ↗ SOURCE REVIEW Reviewed 2026-09-21 Evidence 8 linked sources Publisher Trail of Bits Licence CC-BY-SA-4.0 ↗ Revision 123037ec8aed Read what was—and wasn’t—checked ↓ “Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when” Trail of Bits · upstream description ↗ Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Follows callees and unsuccessful paths instead of trusting names such as validate or authorize. - Keeps detailed prose on disk and returns compact records, preserving unresolved assumptions for later review. ### A good fit for - Learning an unfamiliar codebase before a security audit - Mapping which functions establish a sensitive invariant ### Weigh up before choosing - The skill is a router into a plugin workflow and named function analyzer; a copied standalone SKILL.md is insufficient. - The workflow selects a bounded set of functions rather than guaranteeing complete repository coverage. - Structured return schemas constrain output shape, not the truth or completeness of the analysis. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/audit-context-building/skills/audit-context-building/SKILL.md - plugins/audit-context-building/skills/audit-context-building/resources/ANALYSIS_FORMAT.md - plugins/audit-context-building/skills/audit-context-building/resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md - plugins/audit-context-building/agents/function-analyzer.md - plugins/audit-context-building/workflows/audit-context.js - LICENSE ### Our findings - The inspected workflow separates orientation, per-function analysis and synthesis and records functions below its selection cutoff. - The function analyzer writes prose plus a structured record and requires source lines or explicit open questions. - The synthesis instructions preserve conflicting records and unenforced assumptions rather than silently resolving them into findings. ### Not established by this review - Source inspection only; no skill installation or workflow execution was performed. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. Upstream setup instructions ↗ - Install the complete audit-context-building plugin, including its agents, workflows and references. - Claude Code: add the trailofbits/skills marketplace with /plugin marketplace add trailofbits/skills, then select the plugin in /plugin menu. - The publisher also documents Codex marketplace compatibility; confirm the required workflow and delegation capabilities in the chosen host. ### Before you start - A supported Claude Code or Codex plugin host - Permission for the plugin’s repository reads, outputs and any requested test commands - Complete plugin and read access to relevant source and callees ### Compatibility Trail of Bits plugin hosts with Workflow/Task and schema-bound agent support ### Read repository functions and dependencies - Read repository functions and dependencies - Delegate selected function analysis - Write an audit-context dossier and individual function files ### Cost model The package is CC-BY-SA-licensed; delegated analysis uses the chosen agent service and can consume substantial context. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - Skill definition at reviewed revision ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/skills/audit-context-building/SKILL.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, compatibility, access - Reviewed reference or helper: resources/ANALYSIS_FORMAT.md ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/skills/audit-context-building/resources/ANALYSIS_FORMAT.md Supports: review, limitations, access - Reviewed reference or helper: resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/skills/audit-context-building/resources/FUNCTION_MICRO_ANALYSIS_EXAMPLE.md Supports: review, limitations, access - Reviewed reference or helper: ../../agents/function-analyzer.md ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/agents/function-analyzer.md Supports: review, limitations, access - Reviewed reference or helper: ../../workflows/audit-context.js ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/audit-context-building/workflows/audit-context.js Supports: review, limitations, access - Upstream license or licensing declaration ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/LICENSE Supports: license - Publisher installation and project documentation ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/README.md Supports: install, compatibility, access - Skills installer source formats and selective installation ↗ Checked 2026-09-21 https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md Supports: install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### OpenAI Codex Security Threat Model ↗ Creates or reuses a repository threat model bound to the actual target and revision, preserving supplied context and explicit review gaps.](/skills/openai-threat-model/)[### Trail of Bits Differential Security Review ↗ Reviews security-relevant changes against their baseline, removed protections, callers and concrete attacker scenarios.](/skills/trailofbits-differential-review/)[### Trail of Bits Sharp Edges ↗ Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary.](/skills/trailofbits-sharp-edges/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)