Skill profile
audit-context-building
Reads a codebase function by function, records what each one assumes and depends on, and writes the results to files instead of filling up the conversation — built for pre-audit codebase understanding.
What it actually does
- Reads a codebase function by function and records what each one assumes and depends on.
- Writes the results to files rather than keeping the accumulated context in the conversation — built specifically so a later security review starts from a durable map instead of a fresh read.
When to use it — and when not to
Use it when
- Before a security review or audit of a codebase you don't already know well.
Not for
- You already understand the codebase well — this is a context-building step, not the review itself.
- You need the audit or review; pair it with something like `security-threat-model` for that half of the job.
The caveat that matters
CC-BY-SA-4.0, a share-alike license — worth knowing before forking or redistributing it.
Agent compatibility
- Claude Code
- Cursor— portable
Trail of Bits publishes to the open SKILL.md standard rather than declaring Cursor support directly.
Confirmed means the skill’s own source or vendor states it works with that agent. Portable means it only reaches that agent through the shared SKILL.md format and a directory convention — real, but a weaker claim. An agent with no entry here isn’t known to be unsupported; it simply isn’t documented either way, so nothing is claimed. Full model on Agent Skills Compatibility.
Workflow fit
Codebase mapping → threat modeling / audit → remediation.
Related skills
- security-threat-modelDifferent agents, same phase of the job — audit-context-building maps a codebase before review, security-threat-model produces the review's output.
Evidence and provenance
Maintained by Trail of Bits (vendor). Primary source: trailofbits/skills, last checked against this page’s claims on . This page summarizes and analyzes that source — it isn’t a copy of its SKILL.md or README, and installation happens at the source, not here.
Also covered in The Best Claude Code Skills, part of the Claude Code guide.