static-analysis plugin
Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection
How to install the static-analysis plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add trailofbits/skills
/plugin install static-analysis@trailofbitsWhat's inside static-analysis
3 parts read from the plugin's own files.
Skills 3
Claude loads it when the task matches- codeql
Scans codebases for security vulnerabilities using interprocedural data flow and taint tracking analysis across multiple programming languages.
- sarif-parsing
Parses, filters, and aggregates static analysis scan results from tools like CodeQL and Semgrep using the SARIF standard.
- semgrep
Runs security scans over codebases using automated language detection, ruleset selection, and merged SARIF reporting.
Using static-analysis in Claude Code
Skills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update static-analysis@trailofbits
- Refresh the marketplace
- /plugin marketplace update trailofbits
- Turn it off for now
- /plugin disable static-analysis@trailofbits
- Remove it
- /plugin uninstall static-analysis@trailofbits
Skills in static-analysis
- codeqltrailofbits/skills
Scans codebases for security vulnerabilities using interprocedural data flow and taint tracking analysis across multiple programming languages.
34 files8.1Kstars - sarif-parsingtrailofbits/skills
Parses, filters, and aggregates static analysis scan results from tools like CodeQL and Semgrep using the SARIF standard.
6 files8.1Kstars - semgreptrailofbits/skills
Runs security scans over codebases using automated language detection, ruleset selection, and merged SARIF reporting.
9 files8.1Kstars
static-analysis plugin questions
How do I install the static-analysis plugin?
In Claude Code run /plugin marketplace add trailofbits/skills, then /plugin install static-analysis@trailofbits.
What does the static-analysis plugin include?
static-analysis bundles 3 skills.
How do I update or remove the static-analysis plugin?
Update it with claude plugin update static-analysis@trailofbits in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall static-analysis@trailofbits.