mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Lixin2026
d5fe2e6a78
* feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sharp Edges
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes through developer confusion, laziness, or malice.
When to Use
- Reviewing API designs for security-relevant interfaces
- Auditing configuration schemas that expose security choices
- Evaluating cryptographic library ergonomics
- Assessing authentication/authorization APIs
- Any code review where developers make security-critical decisions
What It Does
Analyzes code and designs through the lens of three adversaries:
- The Scoundrel: Can a malicious developer or attacker disable security via configuration?
- The Lazy Developer: Will copy-pasting the first example lead to insecure code?
- The Confused Developer: Can parameters be swapped without type errors?
Core Principle
The pit of success: Secure usage should be the path of least resistance. If developers must read documentation carefully or remember special rules to avoid vulnerabilities, the API has failed.
Installation
/plugin install trailofbits/skills/plugins/sharp-edges
Sharp Edge Categories
The skill identifies six categories of misuse-prone designs:
| Category | Example |
|---|---|
| Algorithm Selection | JWT alg: none attack; PHP hash("crc32", $password) |
| Dangerous Defaults | session_timeout: 0 meaning infinite; empty password accepted |
| Primitive vs. Semantic APIs | encrypt(msg, bytes, bytes) where key/nonce can be swapped |
| Configuration Cliffs | verify_ssl: false disables all certificate validation |
| Silent Failures | Verification returns False instead of throwing; ignored return values |
| Stringly-Typed Security | Permissions as comma-separated strings; SQL from concatenation |
Agent
The sharp-edges-analyzer agent runs the full analysis workflow autonomously in a subagent context. Use it when you want a dedicated, isolated analysis of APIs, configurations, or interfaces for misuse resistance.
Related Skills
- constant-time-analysis - Detect timing side-channels in cryptographic code
- differential-review - Security-focused code change review
- audit-context-building - Deep architectural analysis before auditing