--- title: "Trail of Bits Sharp Edges: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-sharp-edges/ description: "Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary." --- # Trail of Bits Sharp Edges: review, setup & limitations · Undominated.ai > Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary. [← Explore all skills](/skills/) SECURITY / Trail of Bits # Trail of Bits Sharp Edges Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary. See setup guidance ↓Original source ↗ SOURCE REVIEW Reviewed 2026-09-21 Evidence 6 linked sources Publisher Trail of Bits Licence CC-BY-SA-4.0 ↗ Revision 123037ec8aed Read what was—and wasn’t—checked ↓ “Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether” Trail of Bits · upstream description ↗ Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Looks at zero, empty, negative and mixed-up values rather than only intended happy-path usage. - Considers copy-paste usage and confusing interfaces alongside deliberately hostile callers. ### A good fit for - Reviewing authentication or cryptography API ergonomics - Finding dangerous defaults in a configuration schema ### Weigh up before choosing - This is a design-review method, not a general implementation bug scanner. - The skill and analyzer declare read-only tools; their validation wording must not be mistaken for a runtime exploit test. - Language-specific references and contextual misuse evidence remain necessary before calling a design exploitable. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/sharp-edges/skills/sharp-edges/SKILL.md - plugins/sharp-edges/skills/sharp-edges/references/config-patterns.md - plugins/sharp-edges/agents/sharp-edges-analyzer.md - LICENSE ### Our findings - The inspected configuration reference checks override validation, conflicting settings and constructor parameters as well as defaults. - The analyzer follows surface discovery, edge-case probing, attacker perspectives and evidence validation. - The declared tool surface is Read/Grep/Glob, so the catalogue does not claim it executes proof-of-concept code. ### Not established by this review - Source inspection only; no skill installation or workflow execution was performed. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. Upstream setup instructions ↗ - Install the complete sharp-edges plugin, including its agents, workflows and references. - Claude Code: add the trailofbits/skills marketplace with /plugin marketplace add trailofbits/skills, then select the plugin in /plugin menu. - The publisher also documents Codex marketplace compatibility; confirm the required workflow and delegation capabilities in the chosen host. ### Before you start - A supported Claude Code or Codex plugin host - Permission for the plugin’s repository reads, outputs and any requested test commands - Source and documentation for the API or configuration being reviewed ### Compatibility Trail of Bits plugin hosts · APIs and configuration source available for inspection ### Read and search source, schemas and examples - Read and search source, schemas and examples - Report misuse scenarios; runtime reproduction requires separate tooling and authorization ### Cost model The CC-BY-SA instruction package is separate from the chosen agent’s usage costs. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - Skill definition at reviewed revision ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/sharp-edges/skills/sharp-edges/SKILL.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, compatibility, access - Reviewed reference or helper: references/config-patterns.md ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/sharp-edges/skills/sharp-edges/references/config-patterns.md Supports: review, limitations, access - Reviewed reference or helper: ../../agents/sharp-edges-analyzer.md ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/plugins/sharp-edges/agents/sharp-edges-analyzer.md Supports: review, limitations, access - Upstream license or licensing declaration ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/LICENSE Supports: license - Publisher installation and project documentation ↗ Checked 2026-09-21 https://github.com/trailofbits/skills/blob/123037ec8aed26f0d86327cc39137ee5043e5deb/README.md Supports: install, compatibility, access - Skills installer source formats and selective installation ↗ Checked 2026-09-21 https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md Supports: install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### OpenAI Codex Security Threat Model ↗ Creates or reuses a repository threat model bound to the actual target and revision, preserving supplied context and explicit review gaps.](/skills/openai-threat-model/)[### Trail of Bits Audit Context Building ↗ Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass.](/skills/trailofbits-audit-context-building/)[### Trail of Bits Differential Security Review ↗ Reviews security-relevant changes against their baseline, removed protections, callers and concrete attacker scenarios.](/skills/trailofbits-differential-review/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)