Hugging Face Skills vs Trail of Bits Skills
In short
Hugging Face Skills vs Trail of Bits Skills: both are coding tools on Scriptiii AI Tools. Hugging Face Skills pricing: Free. Free to use. (reported by the maker) Trail of Bits Skills pricing: Free. Free to use. (reported by the maker) Both have 0 upvotes.
- Hugging Face Skills
- Free. Free to use. (reported by the maker)
- Trail of Bits Skills
- Free. Free to use. (reported by the maker)
- Upvotes
- 0 vs 0
| Field | Hugging Face Skills | Trail of Bits Skills |
|---|---|---|
| Page | Hugging Face Skills | Trail of Bits Skills |
| Pricing (maker-reported) | Free. Free to use. | Free. Free to use. |
| Upvotes | 0 | 0 |
| Best for | ai-agents, agent-skill, skill-pack | ai-agents, agent-skill, skill-pack |
| Tagline | Skills for agents to work with Hugging Face Hub, datasets, model training and evaluation. | Trail of Bits skills for security research, vulnerability detection and audit workflows. |
| Website | Visit Hugging Face Skills | Visit Trail of Bits Skills |
Pricing and pricing details come from the maker's submission. They are not independently verified.
Hugging Face Skills
Hugging Face Skills
Hugging Face Skills are definitions for AI/ML tasks like dataset creation, model training, and evaluation. The client plugin marketplaces expose the hf-cli skill as the bootstrap path for core Hub operations; additional workflow skills can be installed on demand with hf skills add <skill-name> or discovered by skill-aware clients over CLI/MCP integrations.
The skills in this repository follow the standardized Agent Skills format.
[!NOTE]
Just want to give your agent access to the Hugging Face Hub? Start withhf-cli. It's the recommended first Skill to install: it teaches your agent everyhfcommand (search models, manage datasets and buckets, launch Spaces, run jobs) and is generated from your locally installed CLI so it stays current.
How do Skills work?
In practice, skills are self-contained folders that package instructions, scripts, and resources together for an AI agent to use on a specific use case. Each folder includes a SKILL.md file with YAML frontmatter (name and description) followed by the guidance your coding agent follows while the skill is active.
[!TIP]
If your agent doesn't support skills, you can useagentsmd/AGENTS.mddirectly as a fallback.
The hf-cli skill in this repository is also available through:
- Cursor Marketplace (https://cursor.com/marketplace/huggingface)
- Codex Plugins Directory (https://developers.openai.com/codex/plugins)
Installation
Hugging Face skills are compatible with Claude Code, Codex, Gemini CLI, and Cursor.
Claude Code
- Register the repository as a plugin marketplace:
/plugin marketplace add huggingface/skills
- Install the CLI skill:
/plugin install hf-cli@huggingface/skills
- To install another Hugging Face skill, use the
hfCLI:
hf skills add <skill-name>
Codex
-
Copy or symlink any skills you want to use from this repository's
skills/directory into one of Codex's standard.agents/skillslocations (for example,$REPO_ROOT/.agents/skillsor$HOME/.agents/skills) as described in the Codex Skills guide. -
Once a skill is available in one of those locations, Codex will discover it using the Agent Skills standard and load the
SKILL.mdinstructions when it decides to use that skill or when you explicitly invoke it. -
If your Codex setup still relies on
AGENTS.md, you can use the generatedagentsmd/AGENTS.mdfile in this repo as a fallback bundle of instructions.
Gemini CLI
-
This repo includes
gemini-extension.jsonto integrate with the Gemini CLI. -
Install locally:
gemini extensions install . --consent
or use the GitHub URL:
gemini extensions install https://github.com/huggingface/skills.git --consent
- See Gemini CLI extensions docs for more help.
Cursor
This repository includes Cursor plugin manifests:
.cursor-plugin/plugin.json.mcp.json(configured with the Hugging Face MCP server URL)
Install from repository URL (or local checkout) via the Cursor plugin flow. The marketplace entry is intentionally limited to hf-cli; use hf skills add <skill-name> to install additional workflow skills.
For contributors, regenerate manifests with:
./scripts/publish.sh
Skills
This repository contains a few skills to get you started. You can also contribute your own skills to the repository.
Available skills
| Name | Description | Documentation |
|---|---|---|
hf-cli | Hugging Face Hub CLI (hf) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. | SKILL.md |
hf-cloud-aws-context-discovery | Discover the user''s local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. | SKILL.md |
hf-cloud-python-env-setup | Set up an isolated Python environment for SageMaker / AWS work, with the right Python version and current boto3. | SKILL.md |
hf-cloud-sagemaker-deployment-planner | Plan and coordinate the deployment of a model to Amazon SageMaker AI. | SKILL.md |
hf-cloud-sagemaker-iam-preflight | Ensure a usable SageMaker execution role exists before deploying or training. | SKILL.md |
hf-cloud-sagemaker-production-defaults | Create a SageMaker endpoint (real-time, real-time scale-to-zero, or async) with autoscaling, CloudWatch alarms, and tagging enabled by default. | SKILL.md |
hf-cloud-serving-image-selection | Pick the right serving container for a SageMaker model deployment and find its current image URI. | SKILL.md |
hf-mem | Hugging Face CLI to estimate the required memory to load Safetensors or GGUF model weights for inference from the Hugging Face Hub | SKILL.md |
huggingface-best | Use when the user asks about finding the best, top, or recommended model for a task, wants to know what AI model to use, or wants to compare models by benchmark scores. | SKILL.md |
huggingface-community-evals | Run evaluations for Hugging Face Hub models using inspect-ai and lighteval on local hardware. | SKILL.md |
huggingface-datasets | Use this skill for Hugging Face Dataset Viewer API workflows that fetch subset/split metadata, paginate rows, search text, apply filters, download parquet URLs, and read size or statistics. | SKILL.md |
huggingface-gradio | Build Gradio web UIs and demos in Python. | SKILL.md |
huggingface-llm-trainer | Train or fine-tune language and vision models using TRL (Transformer Reinforcement Learning) or Unsloth with Hugging Face Jobs infrastructure. | SKILL.md |
huggingface-local-models | Use to select models to run locally with llama.cpp and GGUF on CPU, Mac Metal, CUDA, or ROCm. | SKILL.md |
huggingface-lora-space-builder | Build and publish a Gradio demo on Hugging Face Spaces for a user-provided LoRA. | SKILL.md |
huggingface-paper-publisher | Publish and manage research papers on Hugging Face Hub. | SKILL.md |
huggingface-papers | Look up and read Hugging Face paper pages in markdown, and use the papers API for structured metadata such as authors, linked models/datasets/spaces, Github repo and project page. | SKILL.md |
huggingface-spaces | Build, deploy, and maintain applications on Hugging Face Spaces — Gradio / Docker / Static SDKs, ZeroGPU and dedicated hardware, model loading, debugging, buckets, inference providers, community grants. | SKILL.md |
huggingface-tool-builder | Use this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. | SKILL.md |
huggingface-trackio | Track and visualize ML training experiments with Trackio. | SKILL.md |
huggingface-vision-trainer | Trains and fine-tunes vision models for object detection (D-FINE, RT-DETR v2, DETR, YOLOS), image classification (timm models — MobileNetV3, MobileViT, ResNet, ViT/DINOv3 — plus any Transformers classifier), and SAM/SAM2 segmentation using Hugging Face Transformers on Hugging Face Jobs cloud GPUs. | SKILL.md |
huggingface-zerogpu | AI demos and GPU compute with Gradio Spaces and Hugging Face Spaces ZeroGPU. | SKILL.md |
train-sentence-transformers | Train or fine-tune sentence-transformers models across SentenceTransformer (bi-encoder; dense or static embedding model; for retrieval, similarity, clustering, classification, paraphrase mining, dedup, multimodal), CrossEncoder (reranker; pair scoring for two-stage retrieval / pair classification), and SparseEncoder (SPLADE, sparse embedding model; for learned-sparse retrieval). | SKILL.md |
transformers-js | Use Transformers.js to run state-of-the-art machine learning models directly in JavaScript/TypeScript. | SKILL.md |
trl-training | Train and fine-tune transformer language models using TRL (Transformers Reinforcement Learning). | SKILL.md |
Using skills in your coding agent
Once a skill is installed, mention it directly while giving your coding agent instructions:
- "Use the HF LLM trainer skill to estimate the GPU memory needed for a 70B model run."
- "Use the HF model evaluation skill to launch
run_eval_job.pyon the latest checkpoint." - "Use the HF dataset creator skill to draft new few-shot classification templates."
- "Use the HF paper publisher skill to index my arXiv paper and link it to my model."
Your coding agent automatically loads the corresponding SKILL.md instructions and helper scripts while it completes the task.
Contribute or customize a skill
- Copy one of the existing skill folders (for example,
hf-datasets/) and rename it. - Update the new folder's
SKILL.mdfrontmatter:--- name: my-skill-name description: Describe what the skill does and when to use it --- # Skill Title Guidance + examples + guardrails - Add or edit supporting scripts, templates, and documents referenced by your instructions.
- Do not add the skill to
.claude-plugin/marketplace.jsonby default. Client marketplaces are intentionally limited tohf-cli; the full Hub CLI marketplace is generated at.claude-plugin/marketplace-internal.json. - Run:
to regenerate and validate all generated metadata.
./scripts/publish.sh - Reinstall or reload the skill bundle in your coding agent so the updated folder is available.
Marketplace
The .claude-plugin/marketplace.json and .cursor-plugin/marketplace.json files intentionally expose only hf-cli for client marketplace installation. This keeps install-time manifests focused on core Hub operations and points users to hf skills add <skill-name> for the rest of the repository.
The generated .claude-plugin/marketplace-internal.json file contains the full skill list. Publish automation uploads it to the Hub bucket as marketplace.json so hf skills list, hf skills add, and hf skills update continue to see every available skill.
Newer skill-aware integrations can also pull capabilities dynamically. Hugging Face's discovery flow lets clients search skills, MCP servers, and Spaces, while Skills-over-MCP work is standardizing how skills are discovered and consumed through MCP resources.
Additional references
- Browse the latest instructions, scripts, and templates directly at huggingface/skills.
- Review Hugging Face documentation for the specific libraries or workflows you reference inside each skill.
Trail of Bits Skills
Trail of Bits Skills Marketplace
Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.
Also see: claude-code-config · codex-config · skills-curated · trailmark · calcifier · coop
Installation
Claude Code Marketplace
/plugin marketplace add trailofbits/skills
Browse and Install Plugins
/plugin menu
Codex
Codex supports Claude plugin marketplaces directly, so this repository does not need Codex-specific sidecar metadata.
Install the marketplace with:
codex plugin marketplace add trailofbits/skills
codex plugin list
codex plugin add <plugin-name>@trailofbits
ChatGPT Workspace Marketplace
Use this repository's .claude-plugin/marketplace.json for workspace imports.
Skills that include agents/openai.yaml also need interface.display_name and
interface.short_description in that YAML file; plugin metadata does not supply them.
After a metadata fix is published, sync the repository again in your workspace
marketplace to retry failed imports.
Local Development
To add the marketplace locally (e.g., for testing or development), navigate to the parent directory of this repository:
cd /path/to/parent # e.g., if repo is at ~/projects/skills, be in ~/projects
/plugins marketplace add ./skills
Available Plugins
Smart Contract Security
| Plugin | Description |
|---|---|
| building-secure-contracts | Smart contract security toolkit with vulnerability scanners for 6 blockchains and 5 development guideline assistants |
| entry-point-analyzer | Identify state-changing entry points in smart contracts for security auditing |
Code Auditing
| Plugin | Description |
|---|---|
| agentic-actions-auditor | Audit GitHub Actions workflows for AI agent security vulnerabilities |
| audit-context-building | Understand a codebase before looking for bugs in it, one function at a time |
| burpsuite-project-parser | Search and extract data from Burp Suite project files |
| c-review | Comprehensive C/C++ security code review, with coverage verified against a parse of the source |
| cvss-scoring | Produce CVSS v4.0 vectors with metric justifications and a calculator link |
| differential-review | Security-focused differential review of code changes with git history analysis |
| dimensional-analysis | Annotate codebases with dimensional analysis comments to detect unit mismatches and formula bugs |
| fp-check | Systematic false positive verification for security bug analysis with mandatory gate reviews |
| insecure-defaults | Parallel audit workflow for fail-open insecure defaults, with a refuting verifier per candidate file |
| rust-review | Comprehensive Rust security review covering safe/unsafe boundary, memory safety, concurrency, panic-DoS, FFI, and async runtime with SARIF output |
| semgrep-rule-creator | Create and refine Semgrep rules for custom vulnerability detection |
| semgrep-rule-variant-creator | Port existing Semgrep rules to new target languages with test-driven validation |
| sharp-edges | Identify error-prone APIs, dangerous configurations, and footgun designs |
| static-analysis | Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing |
| supply-chain-risk-auditor | Audit npm, PyPI, and Go dependencies for version-matched advisories, abandoned upstreams, publisher concentration, and install scripts |
| testing-handbook-skills | Skills from the Testing Handbook: fuzzers, static analysis, sanitizers, coverage |
| trailmark | Code graph analysis, bounded subagent context slicing, Mermaid diagrams, mutation testing triage, and protocol verification |
| variant-analysis | Find similar vulnerabilities across codebases using pattern-based analysis |
| vulnerability-triage-brocards | Triage vulnerability reports using 7 brocards to accept, dismiss, or request more info before deeper analysis |
Malware Analysis
| Plugin | Description |
|---|---|
| yara-authoring | YARA detection rule authoring with linting, atom analysis, and best practices |
Verification
| Plugin | Description |
|---|---|
| constant-time-analysis | Detect compiler-induced timing side-channels in cryptographic code |
| mutation-testing | Configure mutation testing, analyze surviving mutants, and investigate bugs in weakly tested code |
| patching-bugs | Reproduce and validate one known bug, commit a scoped patch, and produce reviewable proof and regression reports |
| post-patch-validation | Help patch authors find missed variants and regressions, with reproducible failures and explicit validation gaps |
| property-based-testing | Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants |
| regression-hunt | Find and validate regressions across PRs and commits using discovery, reproduction, and replayed evidence |
| spec-to-code-compliance | Check code against the documentation that specifies it, across contracts, C/C++, services, and firmware |
| writing-lean-proofs | Write structured Lean 4 proofs and design Lean libraries following Mathlib conventions |
| zeroize-audit | Detect missing or compiler-eliminated zeroization of secrets in C/C++ and Rust |
Reverse Engineering
| Plugin | Description |
|---|---|
| dwarf-expert | Analyze DWARF debug info: parse and search DIEs, verify integrity, write DWARF parsing code |
Mobile Security
| Plugin | Description |
|---|---|
| firebase-apk-scanner | Scan Android APKs for Firebase security misconfigurations |
Development
| Plugin | Description |
|---|---|
| code-improver | Autonomous review-and-fix workflow over skills, plugins, or a branch, with a pluggable reviewer, findings ledger, escalation, and scope guard |
| devcontainer-setup | Create pre-configured devcontainers with Claude Code and language-specific tooling |
| gh-cli | Intercept GitHub URL fetches — WebFetch, MCP fetch tools, and curl/wget — and redirect to the authenticated gh CLI |
| git-cleanup | Safely clean up git worktrees and local branches: a dynamic workflow gathers merge evidence and tries to refute its own delete recommendations, behind gated confirmation |
| goal-prompt | Draft /goal commands for goal mode in Claude Code and Codex — verifiable completion conditions formatted to a copy-ready single line |
| github-triage | Triage open GitHub issues and PRs: merge ready bot/approved PRs, review unreviewed ones via subagents, close resolved issues with cited comments, cross-link pending fixes, and score the rest with local-only priority and change-size estimates |
| let-fate-decide | Draw Tarot cards using cryptographic randomness to add entropy to vague planning |
| modern-cpp | Modern C++ best practices (C++20/23/26) with compiler hardening and safe idioms |
| modern-python | Modern Python tooling and best practices with uv, ruff, and pytest |
| open-sourcing | Prepare a repository for public release: secrets hygiene, licensing, CI readiness, and release automation |
| review-walkthrough | Generate an interactive walkthrough of branch changes with ordered diffs, explanations, and anchored review findings |
| second-opinion | Get independent reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits |
Team Management
| Plugin | Description |
|---|---|
| culture-index | Interpret Culture Index survey results for individuals and teams |
Tooling
| Plugin | Description |
|---|---|
| chrome-mcp-troubleshooting | Diagnose and fix Claude in Chrome MCP extension connectivity issues |
Trophy Case
Bugs discovered using Trail of Bits Skills. Found something? Let us know!
When reporting bugs you've found, feel free to mention:
Found using Trail of Bits Skills
| Skill | Bug |
|---|---|
| constant-time-analysis | Timing side-channel in ML-DSA signing |
Contributing
We welcome contributions! See AGENTS.md for skill authoring guidelines, and
run make check before you push — it runs most of CI locally (see AGENTS.md for
what it does not cover).
Codex provides advisory fast reviews for eligible PRs from this repository. Maintainers
with write access can request another fast review by commenting @codex review, or a
deeper review by applying the deep-review label. Fork PRs are excluded.
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Made by Trail of Bits.
Questions
- Do Hugging Face Skills and Trail of Bits Skills list the same price?
- Both listings report Free. Free to use. Pricing is reported by the maker and is not independently verified.
- Which has more upvotes, Hugging Face Skills or Trail of Bits Skills?
- Both have 0 upvotes.
- What does each maker say Hugging Face Skills and Trail of Bits Skills are for?
- Hugging Face Skills: Skills for agents to work with Hugging Face Hub, datasets, model training and evaluation. Trail of Bits Skills: Trail of Bits skills for security research, vulnerability detection and audit workflows.
Hugging Face Skills alternatives·Trail of Bits Skills alternatives·All coding tools