Setup & Installation
npx skills add https://github.com/trailofbits/skills --skill sharp-edges
https://github.com/trailofbits/skills/tree/main/plugins/sharp-edges
View on GitHubWhat This Skill Does
Evaluates whether APIs, configurations, and interfaces are resistant to developer misuse. Focuses on cases where the easy path leads to insecurity, such as algorithm selection footguns, dangerous defaults, silent failures, and stringly-typed security values. Applies the "pit of success" principle: secure usage should be the default, not an opt-in.
Manual code review rarely probes edge cases like timeout=0 or empty-key bypass paths systematically, and this skill works through a structured adversary model covering malicious, lazy, and confused developers.
When to use it
- Auditing a cryptographic library's API for algorithm-selection footguns like accepting 'none' or 'md5'
- Reviewing constructor parameters that accept insecure values despite having safe defaults
- Checking configuration schemas for zero/null/negative values that silently disable security
- Assessing whether JWT or session token APIs expose choices that attackers can control
- Spotting timing-unsafe comparisons that look identical to safe ones at the call site