# Static Analysis (Trail of Bits) (ChatGPT Plugin)

> CodeQL, Semgrep and SARIF parsing skills for security bug hunting

- Type: plugin
- Publisher: Trail of Bits
- Categories: Security, Development
- Website: https://github.com/trailofbits/skills/tree/main/plugins/static-analysis
- Docs: https://github.com/trailofbits/skills#codex
- Source: https://github.com/trailofbits/skills
- GitHub stars: 7320
- Listed: 2026-01-14

## About

Static analysis toolkit with CodeQL, Semgrep and SARIF parsing skills for security vulnerability detection. Part of the Trail of Bits skills marketplace (44 plugins), a Claude Code plugin marketplace that Codex can load through its Claude marketplace compatibility.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Static Analysis (Trail of Bits)” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

2. **Or install it in Codex**

   Codex CLI:

   ```bash
   codex plugin marketplace add trailofbits/skills
   codex plugin add static-analysis@trailofbits
   ```

## Disconnect or uninstall

1. **In ChatGPT** Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Static Analysis (Trail of Bits) in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.

2. **In Codex**

   Codex CLI:

   ```bash
   codex plugin remove static-analysis@trailofbits
   ```

## Example prompts

- "Run Semgrep on this repo and triage the findings"
- "Write a CodeQL query for this injection pattern"
- "Parse this SARIF file and summarize high-severity results"

## Static Analysis (Trail of Bits) alternatives

- [Superpowers](https://chatgptplugins.directory/plugins/superpowers.md): Plan, develop, and debug code
- [Codex Security](https://chatgptplugins.directory/plugins/codex-security.md): Security scanning for your codebase
- [Build Web Apps](https://chatgptplugins.directory/plugins/build-web-apps.md): Build frontend-focused web apps with generated assets, browser testing, payments, and...
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Figma](https://chatgptplugins.directory/plugins/figma.md): Figma design-to-code workflows
- [Shopify](https://chatgptplugins.directory/plugins/shopify.md): Build and manage your store

---
Source: https://chatgptplugins.directory/plugins/trailofbits-static-analysis · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.