* feat(codex): add skill UI metadata
* Use official Trail of Bits logo
* fix: resolve code review findings for PR #175
Codex silently drops the icons as authored: its loader
(codex-rs/core-skills resolve_asset_path) requires icon paths
containing '..' to resolve under <plugin_root>/assets/, and the
repo-root .codex/assets location fails that containment check.
Verified empirically via codex app-server plugin/read: every
iconSmall/iconLarge came back null; only brand_color applied.
P1 fixed:
- Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for
all 38 plugins with skills and point every openai.yaml at
../../assets/trail-of-bits-mark.svg (the supported plugin-level
shared asset pattern). Icons now resolve for marketplace
installs too, since nothing escapes the plugin root.
- Drop the .codex/ additions: .codex/skills/gh-cli/agents/
openai.yaml resolved nowhere (.codex/skills is not a Codex
discovery root) and PR #173 removes the whole .codex/ tree
P2 fixed:
- Patch-bump all 38 touched plugins in plugin.json and
marketplace.json so installed clients pick up the metadata
Verified:
- Static check replicating Codex's resolution algorithm: all 73
yaml files resolve under their plugin assets/ and exist
- Live codex app-server probe: 71/72 loadable skills report
resolved iconSmall/iconLarge and brand_color #D83A34
(claude-in-chrome-troubleshooting fails to load on main due to
a pre-existing 64-char qualified-name limit, fixed by #173's
rename; zeroize-audit's manifest mcpServers object is likewise
a pre-existing Codex incompatibility fixed by #173)
- validate_codex_skills.py, validate_plugin_metadata.py, prek all
pass
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(codex): use skill-local icon assets
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(aflpp): add opinionated environment variables guide
Add a practical "Environment Variables That Matter" section covering:
- Always-set variables (AFL_TMPDIR, AFL_FAST_CAL) for free perf wins
- Multi-core campaign variables (AFL_FINAL_SYNC, AFL_TESTCACHE_SIZE)
- CI/automated fuzzing variables (AFL_EXIT_ON_TIME, AFL_NO_UI)
- Variables to avoid (AFL_NO_ARITH, AFL_SHUFFLE_QUEUE, AFL_DISABLE_TRIM)
Follow-up from PR #15 review feedback.
Closes#18
* docs(aflpp): address review feedback on env vars guide
- AFL_FAST_CAL: clarify it's recommended for slow targets, not universal
- AFL_FINAL_SYNC: correct scope to afl-cmin corpus minimization
- AFL_TESTCACHE_SIZE: add default (50 MB) and recommended range (50-250)
- AFL_NO_ARITH: note it may help for text-based formats
* fix: address review feedback on AFL env vars descriptions
- AFL_FAST_CAL: move to its own "Slow Targets" section to clarify it's
specifically recommended for slow targets, not always
- AFL_FINAL_SYNC: clarify it only matters for afl-cmin corpus
minimization, not for the fuzzing process itself
- AFL_TESTCACHE_SIZE: mention default is 50 MB and good range is 50-250 MB
- AFL_NO_ARITH: soften wording to note it may be useful for text-based targets
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Pre-commit hooks auto-fixed missing newlines at EOF and trailing
whitespace to satisfy end-of-file-fixer and trailing-whitespace checks.
Co-authored-by: Dallas McIntyre <dkmcintyre@safaricircuits.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
* init codeql merge
* test and improve
* test and improve 2
* test and improve 3
* test and improve 4, bump version, fix authors
* Bump testing-handbook-skills version for codeql skill removal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* init merge and rewrite
* semgrep done
* fix semgrep version
* Fix review issues in semgrep skill
- Replace destructive `semgrep logout` with non-destructive Pro detection
- Align marketplace.json description with plugin.json
- Add subagent_type guidance (Bash for scanners, general-purpose for triage)
- Use npx --no-install instead of --yes to prevent auto-installing packages
- Fix ruff formatting on merge_triaged_sarif.py
- Simplify brittle run number generation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix authors
* mend
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix and improve aflpp skill
* Fix typo and wrapper inconsistency in AFL++ skill
- Fix "envinroment" → "environment" typo
- Use ./afl++ wrapper consistently in libpng example
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* ci: add lint enforcement with ruff, shellcheck, and shfmt
Add pre-commit hooks (prek) and GitHub Actions CI to enforce Python and
shell linting across the repository.
- Add root pyproject.toml with ruff configuration (line-length=100, py311)
- Add .pre-commit-config.yaml with ruff, shellcheck, shfmt, and standard hooks
- Add .github/workflows/lint.yml with SHA-pinned actions
- Update .github/dependabot.yml with root pip ecosystem entry
- Fix existing lint violations:
- Auto-fix imports and formatting with ruff
- Fix duplicate dict key in ct_analyzer (contentequals -> arrays.contentequals)
- Add noqa comment for required sys.path manipulation in extract_pdf.py
- Format shell scripts with shfmt (case statement indentation)
- Add per-file-ignores for ct_analyzer's long opcode tables and style patterns
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use 2-space indentation for shell scripts
Change shfmt configuration from 4-space to 2-space indentation
to match CLAUDE.md standards.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Lixin2026