What is static-analysis?
static-analysis is a Claude skill by trailofbits that static analysis toolkit with CodeQL, Semgrep, and SARIF. It is listed under Other and has 7,623 GitHub stars.
| Type | Claude skill |
|---|---|
| Author | trailofbits |
| Repository | trailofbits/skills |
| Popularity | 7,623 GitHub stars |
| Category | Other |
| Security | Not scanned |
| Rank | #379 of 1,262 Claude skills; #85 in Other |
| License | CC-BY-SA-4.0 |
| Last commit | 2026-10-15 |
| Stars this week | +142 |
Is static-analysis safe to install?
We have not scanned static-analysis yet because its SKILL.md could not be fetched. Read the source before installing.
| Check | Result |
|---|
How do I install static-analysis?
- Install with the skills CLI. Works for Claude Code and other agents that read skills.
npx skills add https://github.com/trailofbits/skills --skill static-analysis
- Or copy it by hand. Claude Code loads any folder with a SKILL.md from ~/.claude/skills.
git clone https://github.com/trailofbits/skills cp -r skills/static-analysis ~/.claude/skills/static-analysis
- Use it. Claude loads the skill when a task matches its description. You can also name it in your prompt.
Use the static-analysis skill to …
Or ask Claude to set it up
Paste this into Claude Code and it installs static-analysis for you:
Install the "static-analysis" skill from https://github.com/trailofbits/skills into ~/.claude/skills, then tell me in one line what it does.
More from trailofbits/skills
This repository has at least 9 Claude skills on MCPMods.
- ask-questions-if-underspecified: Prompt for clarification on ambiguous requirements (Not scanned)
- audit-context-building: Deep architectural context via ultra-granular code analysis (Not scanned)
- building-secure-contracts: Smart contract security toolkit with vulnerability scanners for 6 blockchains (Not scanned)
- burpsuite-project-parser: Search and extract data from Burp Suite project files (Not scanned)
- claude-in-chrome-troubleshooting: Diagnose and fix Claude in Chrome MCP extension connectivity issues (Not scanned)
- constant-time-analysis: Detect compiler-induced timing side-channels in crypto code (Not scanned)
- culture-index: Index and search culture documentation (Not scanned)
- differential-review: Security-focused diff review with git history analysis (Not scanned)