SECURITY / trailofbits
DWARF Debug Information
Inspect DWARF symbols, types, line tables and address mappings using tool-specific commands.
“Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with”
01 / THE REASONING
Why this made the selection.
- The skill reads DWARF with local dumpers and, when the standard matters, tells the agent to look up dwarfstd.org rather than answer from memory.
- It draws a hard line against runtime debugging and against treating a linked macOS executable as the DWARF container.
- The definition distinguishes address lookup from DIE-offset lookup and warns about missing accelerator tables and optional attributes.
- Explain missing source mappings or inspect type DIE relationships
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/dwarf-expert/skills/dwarf-expert/SKILL.md
- LICENSE
- README.md
Our findings
- Declared tools include WebSearch and WebFetch for the DWARF standard, plus local Read, Write, Edit, and Bash for dumps and scripts.
- Linked macOS executables are the wrong input: DWARF stays in the object files or the dSYM, and pyelftools does not parse Mach-O.
- Runtime debugging with gdb or lldb, and reverse engineering beyond the DWARF sections, are named as out of scope.
- The definition distinguishes address lookup from DIE-offset lookup and warns about missing accelerator tables and optional attributes.
Not established by this review
- The resource was not executed and its tools were not called.
- dwarfdump, readelf, and pyelftools were not run.
- No skill execution, authenticated service operation, or outcome benchmark was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add trailofbits/skills/plugins/dwarf-expert/skills/dwarf-expertRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/dwarf-expert/skills/dwarf-expert- Install the pinned skill directory interactively, retaining its bundled references and scripts.
- Identify binary format, debug companion files and dwarfdump implementation.
- Use structural verification and follow abstract-origin/specification references before concluding an attribute is absent.
Before you start
- A local checkout and the tools required by the selected workflow
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Pinned skill definition ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/dwarf-expert/skills/dwarf-expert/SKILL.md
Supports: summary, whySelected, bestFor, limitations, install, access, review
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: install
- CC-BY-SA-4.0 licence ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: license