SECURITY / Trail of Bits
Trail of Bits Sharp Edges
Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary.
“Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether”
01 / THE REASONING
Why this made the selection.
- Looks at zero, empty, negative and mixed-up values rather than only intended happy-path usage.
- Considers copy-paste usage and confusing interfaces alongside deliberately hostile callers.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/sharp-edges/skills/sharp-edges/SKILL.md
- plugins/sharp-edges/skills/sharp-edges/references/config-patterns.md
- plugins/sharp-edges/agents/sharp-edges-analyzer.md
- LICENSE
Our findings
- The inspected configuration reference checks override validation, conflicting settings and constructor parameters as well as defaults.
- The analyzer follows surface discovery, edge-case probing, attacker perspectives and evidence validation.
- The declared tool surface is Read/Grep/Glob, so the catalogue does not claim it executes proof-of-concept code.
Not established by this review
- Source inspection only; no skill installation or workflow execution was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
- Install the complete sharp-edges plugin, including its agents, workflows and references.
- Claude Code: add the trailofbits/skills marketplace with /plugin marketplace add trailofbits/skills, then select the plugin in /plugin menu.
- The publisher also documents Codex marketplace compatibility; confirm the required workflow and delegation capabilities in the chosen host.
Before you start
- A supported Claude Code or Codex plugin host
- Permission for the plugin’s repository reads, outputs and any requested test commands
- Source and documentation for the API or configuration being reviewed
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/sharp-edges/skills/sharp-edges/SKILL.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, compatibility, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/sharp-edges/skills/sharp-edges/references/config-patterns.md
Supports: review, limitations, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/sharp-edges/agents/sharp-edges-analyzer.md
Supports: review, limitations, access
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/LICENSE
Supports: license
https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/README.md
Supports: install, compatibility, access
https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md
Supports: install