20 Trail of Bits Static Analysis alternatives
Trail of Bits Static Analysis: CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents. 20 agent skills do similar work, most sharing Code Review, Security and Static Analysis, ranked by how much they have in common with Trail of Bits Static Analysis.
Back to Trail of Bits Static Analysis
-
by Trail of Bits
Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.
Also: CodeQL, Security, Static Analysis
-
by Trail of Bits
Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.
Also: Security, Semgrep, Static Analysis
-
by Trail of Bits
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
Also: Security, Static Analysis
-
by Trail of Bits
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
Also: Security, Static Analysis
-
by Trail of Bits
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
Also: Code Review, Security
-
by OpenQodex
Open source pre-push AI code review for Claude Code and Codex: scanners plus a separate reviewer that verifies every finding.
Also: Code Review, Security
-
by OpenAI
OpenAI's skill for language- and framework-specific secure coding: detect the stack, load the matching reference guidance, then write secure-by-default code, flag critical issues passively, or produce a prioritised vulnerability report with fixes.
Also: Code Review, Security
-
by OpenAI
OpenAI's skill for repository-grounded threat modelling: derive trust boundaries, assets and attacker capabilities from the actual code, rank abuse paths by likelihood and impact, and write a reviewable Markdown threat model.
Also: Code Review, Security
-
by Sentry
Review pull requests against a real engineering practice — security, performance, testing, and design, in that order.
Also: Code Review, Security
-
by CodeRabbit
Pull unresolved CodeRabbit review threads from your PR and apply the fixes one at a time, treating every reviewer comment as untrusted input rather than an instruction.
Also: Code Review
-
by Alibaba Group
Alibaba's open-source AI code review CLI as an agent skill: line-level comments on diffs, branches and commits, with optional auto-fix.
Also: Code Review
-
by Vercel
Vercel's official skill for auditing UI code against the Web Interface Guidelines — accessibility, performance and UX rules reported as terse file:line findings.
Also: Code Review
-
by Addy Osmani
Sends every non-trivial decision to a fresh-context adversarial reviewer before it stands — for production, security-sensitive or irreversible work.
Also: Code Review
-
by Sentry
Sentry's Django performance review skill — hunts N+1 queries, unbounded querysets, missing indexes and write loops, and reports only findings it can prove.
Also: Code Review
-
by Microsoft
The .NET team's official skill for scanning C# against ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex and I/O.
Also: Code Review
-
by Jesse Vincent
Respond to code review feedback with technical rigour — verify each point instead of agreeing with everything.
Also: Code Review
-
by Jesse Vincent
Prepare and request a code review that checks the work against its original requirements, not just its syntax.
Also: Code Review
-
by Jesse Vincent
An agentic software-development methodology: composable skills that push a coding agent through spec, plan, TDD and review instead of straight into code.
Also: Code Review
-
by Inngest
An evidence-first audit skill: walk an existing TypeScript repo, name the exact call sites where background work can be lost, and land an incremental durability plan.
Also: Code Review
-
by Vercel
Vercel's official skill for reviewing documentation and prose against its writing handbook — voice, structure, code samples and typography, reported as file:line findings.
Also: Code Review
