Expo Skills vs Trail of Bits Skills
In short
Expo Skills vs Trail of Bits Skills: both are coding tools on Scriptiii AI Tools. Expo Skills pricing: Free. Free to use. (reported by the maker) Trail of Bits Skills pricing: Free. Free to use. (reported by the maker) Both have 0 upvotes.
- Expo Skills
- Free. Free to use. (reported by the maker)
- Trail of Bits Skills
- Free. Free to use. (reported by the maker)
- Upvotes
- 0 vs 0
| Field | Expo Skills | Trail of Bits Skills |
|---|---|---|
| Page | Expo Skills | Trail of Bits Skills |
| Pricing (maker-reported) | Free. Free to use. | Free. Free to use. |
| Upvotes | 0 | 0 |
| Best for | ai-agents, agent-skill, skill-pack | ai-agents, agent-skill, skill-pack |
| Tagline | Agent skills for building Expo and React Native apps and using Expo Application Services. | Trail of Bits skills for security research, vulnerability detection and audit workflows. |
| Website | Visit Expo Skills | Visit Trail of Bits Skills |
Pricing and pricing details come from the maker's submission. They are not independently verified.
Expo Skills
Expo Skills
Official AI agent skills from the Expo team for building, deploying, upgrading, and debugging Expo apps.
How It Works
Skills give AI agents focused Expo knowledge: when to use Expo APIs, how to structure common workflows, and which Expo, EAS, React Native, iOS, and Android constraints matter. Expo documentation, Expo CLI, and EAS CLI remain the source of truth; these skills help agents apply them correctly.
Installation
For Claude Code or Codex, install the plugin so updates are handled by the official plugin marketplace. For Cursor, OpenCode, and other AI coding agents, use the skills CLI.
| Path | Best for |
|---|---|
| Plugin install | Claude Code or Codex, with updates handled by their official plugin marketplaces. |
| Skills CLI | Cursor, OpenCode, GitHub Copilot, Windsurf, Gemini, Cline, AMP, Factory Droid, Antigravity, Kiro CLI, and other AI coding agents. |
Skills CLI
Install all Expo skills with the skills CLI:
npx skills@latest add expo/skills --skill '*'
This selects every Expo skill without selecting every agent. The CLI will still ask where to install them; to target one agent directly, add --agent <agent>.
For most agents, this is the only install command you need. Run it from the project root, then restart or refresh your agent session so it can discover the installed SKILL.md files.
Claude Code Plugin
Install from the official Claude Code plugin marketplace:
claude plugin install expo@claude-plugins-official
You can also run /plugin install expo@claude-plugins-official inside Claude Code.
Codex Plugin
Install from the OpenAI-curated Codex marketplace:
codex plugin add expo@openai-curated
You can also open /plugins in Codex and install expo from the OpenAI-curated marketplace.
Updating
Claude Code and Codex plugin installs are updated through their official plugin marketplaces.
For skills CLI installs, update installed skills with:
npx skills@latest update
To update a single Expo skill, pass its name:
npx skills@latest update expo-router
Try It
After installing, ask your agent Expo-specific questions like:
- "Build a native-feeling Expo Router screen with tabs, modals, and animations."
- "Create an EAS workflow that builds previews on pull requests."
- "Help me upgrade this app to the latest Expo SDK."
- "Check whether this EAS Update rollout is healthy."
Agents choose the right skill from the task context and each skill's description.
Skills Included
Skills come in two groups so the free vs paid boundary is clear. Each skill's description carries the same label, and every services skill opens with a costs/plan-limits note.
Start Here
Load this first for any Expo/EAS task, then route to the specific skill below.
| Skill | Use it for |
|---|---|
expo-overview | Router and shared setup rules; the entry point when a request is vague or the user hasn't named a specific Expo tool. |
Framework (open source)
Free, open-source Expo SDK and React Native skills.
| Skill | Use it for |
|---|---|
expo-project-structure | Folder structure for a new Expo app: src/ layout, routes-only app/, screens, server code, platform-specific files. |
expo-router | Expo Router navigation: file-based routes, links, native stacks, modals, sheets, native tabs, and headers. |
expo-animation | Polished React Native animations and gestures with Reanimated, Gesture Handler, Expo Router, and expo-haptics. |
expo-native-ui | Native-feeling screen styling, semantic colors, controls, icons, media, and visual effects. |
expo-design-system | In-app design systems: a token theme (color, spacing, typography, radius, shadow, motion), reusable component conventions, and design-system drift audits. |
expo-ui | @expo/ui native components: universal cross-platform first, with SwiftUI and Jetpack Compose for platform-specific needs. |
expo-data-fetching | API calls, React Query, SWR, caching, offline support, and Expo Router data loaders. |
expo-dom | Expo DOM components for gradually using web code in native apps. |
expo-web-to-native | Migrating an existing web/React app (Next.js, Vite, CRA) to a native iOS/Android app with Expo. |
expo-module | Expo native modules and views with Swift, Kotlin, TypeScript, config plugins, and autolinking. |
expo-brownfield | Adding Expo or React Native to an existing iOS or Android app. |
expo-dev-client | Development clients (local builds are free; EAS Build/TestFlight is a paid step). |
expo-examples | The expo/examples repo of with-* integrations to adapt or scaffold a new project from. |
expo-app-clip | iOS App Clip targets, AASA files, associated domains, and Smart App Banners. |
expo-upgrade | Expo SDK upgrades, dependency conflicts, deprecated packages, and cache cleanup. |
Services & paid distribution
Skills whose core purpose uses paid Expo Application Services (EAS).
| Skill | Use it for |
|---|---|
eas-app-stores | Build and submit iOS/Android apps: Expo and other React Native projects, plus existing native apps; TestFlight, profiles, versioning, and metadata. |
eas-hosting | Deploying Expo websites and Expo Router API routes to EAS Hosting: secrets, custom domains, Cloudflare Workers. |
eas-workflows | EAS Workflow YAML files and CI/CD automation. |
eas-observe | EAS Observe setup and launch, route, event, and version metrics. |
eas-update | EAS Update setup, OTA publishing, runtime compatibility, testing, and debugging. |
eas-update-insights | EAS Update health, crash rates, launch counts, payload size, and rollout gates. |
eas-simulator | Run and drive your app on a remote iOS simulator or Android emulator on EAS cloud - from the CLI or an agent, with a live browser preview (iOS only). |
Experimental
Skills for Expo APIs that are not finalized. Content may change or be retired; skills graduate to the groups above when the underlying API stabilizes. These ship in the separate expo-experiments plugin (install it alongside expo), or individually via the skills CLI.
| Skill | Use it for |
|---|---|
expo-migrate-module | Migrating a Swift Expo module from the Modules API 1.0 definition DSL to the 2.0 macro API. |
Expo MCP Server
Skills teach an agent how Expo work gets done. The Expo MCP server gives it live access to actually do that work: read the latest Expo docs on demand, install compatible dependencies with npx expo install, trigger and monitor EAS builds and workflows, pull crash data from TestFlight, and screenshot a running app in the simulator.
The expo plugin bundles this MCP configuration, so Claude Code and Codex plugin installs wire it up automatically. For other agents, or to add it on its own, follow the Expo MCP setup guide.
FAQ
Which AI coding agents are supported?
Use npx skills@latest add expo/skills --skill '*' for Cursor, OpenCode, GitHub Copilot, Windsurf, Gemini, Cline, AMP, Factory Droid, Antigravity, Kiro CLI, and similar AI coding tools.
Should I install the skills or the plugin?
Use the plugin for Claude Code or Codex; it stays updated through the plugin marketplace. Use npx skills@latest add expo/skills --skill '*' for Cursor, OpenCode, and other AI coding agents.
What is the source of truth?
Expo documentation, Expo CLI, and EAS CLI are the source of truth. These skills teach agents how to apply Expo guidance in real projects.
Feedback
Every skill includes instructions to submit specific, actionable feedback with npx --yes @expo/agent-cli@latest feedback.
License
MIT
Trail of Bits Skills
Trail of Bits Skills Marketplace
Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.
Also see: claude-code-config · codex-config · skills-curated · trailmark · calcifier · coop
Installation
Claude Code Marketplace
/plugin marketplace add trailofbits/skills
Browse and Install Plugins
/plugin menu
Codex
Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata.
Install the marketplace with:
codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits
ChatGPT Workspace Marketplace
Use this repository's .claude-plugin/marketplace.json for workspace imports.
Skills that include agents/openai.yaml also need interface.display_name and
interface.short_description in that YAML file; plugin metadata does not supply them.
After a metadata fix is published, sync the repository again in your workspace
marketplace to retry failed imports.
Local Development
To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:
cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills
Available Plugins
Smart Contract Security
| Plugin | Description |
|---|---|
| building-secure-contracts | Smart contract security toolkit with vulnerability scanners for 6 blockchains and 5 development guideline assistants |
| entry-point-analyzer | Identify state-changing entry points in smart contracts for security auditing |
Code Auditing
| Plugin | Description |
|---|---|
| agentic-actions-auditor | Audit GitHub Actions workflows for AI agent security vulnerabilities |
| audit-context-building | Understand a codebase before looking for bugs in it, one function at a time |
| burpsuite-project-parser | Search and extract data from Burp Suite project files |
| c-review | Comprehensive C/C++ security code review, with coverage verified against a parse of the source |
| cvss-scoring | Produce CVSS v4.0 vectors with metric justifications and a calculator link |
| differential-review | Security-focused differential review of code changes with git history analysis |
| dimensional-analysis | Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs |
| fp-check | Systematic false positive verification for security bug analysis with mandatory gate reviews |
| insecure-defaults | Parallel audit workflow for fail-open insecure defaults, with a refuting verifier per candidate file |
| rust-review | Comprehensive Rust security review covering safe/unsafe boundary, memory safety, concurrency, panic-DoS, FFI, and async runtime with SARIF output |
| semgrep-rule-creator | Create and refine Semgrep rules for custom vulnerability detection |
| semgrep-rule-variant-creator | Port existing Semgrep rules to new target languages with test-driven validation |
| sharp-edges | Identify error-prone APIs, dangerous configurations, and footgun designs |
| static-analysis | Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing |
| supply-chain-risk-auditor | Audit npm, PyPI, and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration, and install scripts |
| testing-handbook-skills | Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage |
| trailmark | Code graph analysis, bounded subagent context slicing, Mermaid diagrams, mutation testing triage, and protocol verification |
| variant-analysis | Find similar vulnerabilities across codebases using pattern-based analysis |
| vulnerability-triage-brocards | Triage vulnerability reports using 7 brocards to accept, dismiss, or request more info before deeper analysis |
Malware Analysis
| Plugin | Description |
|---|---|
| yara-authoring | YARA detection rule authoring with linting, atom analysis, and best practices |
Verification
| Plugin | Description |
|---|---|
| constant-time-analysis | Detect compiler-induced timing side-channels in cryptographic code |
| mutation-testing | Configure mutation testing, analyze surviving mutants, and investigate bugs in weakly tested code |
| patching-bugs | Reproduce and validate one known bug, commit a scoped patch, and produce reviewable proof and regression reports |
| post-patch-validation | Help patch authors find missed variants and regressions, with reproducible failures and explicit validation gaps |
| property-based-testing | Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants |
| regression-hunt | Find and validate regressions across PRs and commits using discovery, reproduction, and replayed evidence |
| spec-to-code-compliance | Check code against the documentation that specifies it, across contracts, C/C++, services, and firmware |
| writing-lean-proofs | Write structured Lean 4 proofs and design Lean libraries following Mathlib conventions |
| zeroize-audit | Detect missing or compiler-eliminated zeroization of secrets in C/C++ and Rust |
Reverse Engineering
| Plugin | Description |
|---|---|
| dwarf-expert | Analyze DWARF debug info: parse and search DIEs, verify integrity, write DWARF parsing code |
Mobile Security
| Plugin | Description |
|---|---|
| firebase-apk-scanner | Scan Android APKs for Firebase security misconfigurations |
Development
| Plugin | Description |
|---|---|
| code-improver | Autonomous review-and-fix workflow over skills, plugins, or a branch, with a pluggable reviewer, findings ledger, escalation, and scope guard |
| devcontainer-setup | Create pre-configured devcontainers with Claude Code and language-specific tooling |
| gh-cli | Intercept GitHub URL fetches — WebFetch, MCP fetch tools, and curl/wget — and redirect to the authenticated gh CLI |
| git-cleanup | Safely clean up git worktrees and local branches: a dynamic workflow gathers merge evidence and tries to refute its own delete recommendations, behind gated confirmation |
| goal-prompt | Draft /goal commands for goal mode in Claude Code and Codex — verifiable completion conditions formatted to a copy-ready single line |
| github-triage | Triage open GitHub issues and PRs: merge ready bot/approved PRs, review unreviewed ones via subagents, close resolved issues with cited comments, cross-link pending fixes, and score the rest with local-only priority and change-size estimates |
| let-fate-decide | Draw Tarot cards using cryptographic randomness to add entropy to vague planning |
| modern-cpp | Modern C++ best practices (C++20/23/26) with compiler hardening and safe idioms |
| modern-python | Modern Python tooling and best practices with uv, ruff, and pytest |
| open-sourcing | Prepare a repository for public release: secrets hygiene, licensing, CI readiness, and release automation |
| review-walkthrough | Generate an interactive walkthrough of branch changes with ordered diffs, explanations, and anchored review findings |
| second-opinion | Get independent reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits |
Team Management
| Plugin | Description |
|---|---|
| culture-index | Interpret Culture Index survey results for individuals and teams |
Tooling
| Plugin | Description |
|---|---|
| chrome-mcp-troubleshooting | Diagnose and fix Claude in Chrome MCP extension connectivity issues |
Trophy Case
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
When reporting bugs you've found, feel free to mention:
Found using Trail of Bits Skills
| Skill | Bug |
|---|---|
| constant-time-analysis | Timing side-channel in ML-DSA signing |
Contributing
We welcome contributions! See AGENTS.md for skill authoring guidelines, and
run make check before you push — it runs most of CI locally (see AGENTS.md for
what it does not cover).
Codex provides advisory fast reviews for eligible PRs from this repository. Maintainers
with write access can request another fast review by commenting @codex review, or a
deeper review by applying the deep-review label. Fork PRs are excluded.
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.
Questions
- Do Expo Skills and Trail of Bits Skills list the same price?
- Both listings report Free. Free to use. Pricing is reported by the maker and is not independently verified.
- Which has more upvotes, Expo Skills or Trail of Bits Skills?
- Both have 0 upvotes.
- What does each maker say Expo Skills and Trail of Bits Skills are for?
- Expo Skills: Agent skills for building Expo and React Native apps and using Expo Application Services. Trail of Bits Skills: Trail of Bits skills for security research, vulnerability detection and audit workflows.
Expo Skills alternatives·Trail of Bits Skills alternatives·All coding tools