mirror of https://github.com/trailofbits/skills synced 2026-06-21 14:12:00 +00:00

Files

T

Jonathan Hefner debfb29c8e Fix allowed-tools to use spec-compliant space-delimited strings (#139 )

* Fix `allowed-tools` to use spec-compliant space-delimited strings

Per the agentskills.io specification, `allowed-tools` must be a single
string of space-delimited patterns, not a YAML list. Converted all 23
SKILL.md files from the `- Item` list format to the correct
`"Item1 Item2"` string format. Also updated the frontmatter examples in
CLAUDE.md and the workflow-skill-design skill template to match.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Fix remaining allowed-tools format in firebase-apk-scanner and workflow-skill-design docs

- Convert firebase-apk-scanner from comma-separated to space-delimited
- Update anti-patterns.md and tool-assignment-guide.md examples from YAML lists to space-delimited strings
- Remove unnecessary quotes from SKILL.md template placeholder

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Cover commands, new SKILL.md files, and fix template placeholder

Extends the previous spec-compliance fixes:

* Convert command frontmatter (commands/*.md) — per Claude Code
docs, command files use the same frontmatter as skills, so the
same space-delimited rule applies.
* Convert three SKILL.md files added since the original PR:
mutation-testing, trailmark-structural, trailmark-summary.
* Fix the placeholder in the workflow-skill-design template.
The previous "[minimum tools needed, space-delimited]" was YAML
flow-sequence syntax, which parses as a list — the opposite of
what the placeholder claims. Replaced with a concrete-looking
space-delimited example plus a comment.

Zeroize-audit agent files still use `allowed-tools:` in YAML list
form. They are intentionally excluded: per the project's own docs
(workflow-skill-design references), agents declare tools with
`tools:` (not `allowed-tools:`). Fixing those requires changing
the field name as well as the format and is out of scope for this
PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* zeroize-audit agents: switch allowed-tools to tools

Subagents declare their tool allowlist via `tools:` (comma-separated),
not `allowed-tools:` — see Claude Code's subagent docs and this
repo's own designing-workflow-skills/SKILL.md:47:

> Skills use `allowed-tools:` in frontmatter. Agents use `tools:`
> in frontmatter.

Before this change, the zeroize-audit agents declared their tool list
under `allowed-tools:`, which Claude Code does not read for subagents.
The field was effectively a no-op; the spawned agents had no tool
restriction enforced.

Renames the field on all 11 agents to `tools:` and reformats the YAML
list as comma-separated to match the documented format and existing
agents elsewhere in the repo (e.g. function-analyzer.md,
spec-compliance-checker.md). Tool sets are unchanged.

Behavior change: tools now actually constrain what each spawned agent
can call. The lists are the ones the original author intended.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* skill-improver: convert command allowed-tools to space-delimited

The two command files in plugins/skill-improver/commands/ still used
the JSON flow-array format (`allowed-tools: ["..."]`), which the rest
of this PR converted everywhere else. Convert them to the spec-compliant
space-delimited string form for consistency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Dan Guido <dan@trailofbits.com>

2026-04-28 19:50:30 -04:00

.claude-plugin

Initial release of Trail of Bits Skills Marketplace

2026-01-14 15:24:03 -05:00

skills/dwarf-expert

Fix allowed-tools to use spec-compliant space-delimited strings (#139 )

2026-04-28 19:50:30 -04:00

README.md

Initial release of Trail of Bits Skills Marketplace

2026-01-14 15:24:03 -05:00

README.md

DWARF Expert

Interact with and analyze DWARF debug files, understand the DWARF debug format/standard, and write code that parses DWARF data.

Author: Evan Hellman

When to Use

Use this skill when you need to:

Understand or parse DWARF debug information from compiled binaries
Answer questions about the DWARF standard (v3, v4, v5)
Write or review code that interacts with DWARF data
Use dwarfdump or readelf to extract debug information
Verify DWARF data integrity using llvm-dwarfdump --verify
Work with DWARF parsing libraries (libdwarf, pyelftools, gimli, etc.)

What It Does

This skill provides expertise on:

DWARF standards (v3-v5) via web search and authoritative source references
Parsing DWARF files using dwarfdump and readelf commands
Verification workflows using llvm-dwarfdump --verify and --statistics
Library recommendations for DWARF parsing in C/C++, Python, Rust, Go, and .NET
DIE (Debug Information Entry) analysis and searching
Understanding DWARF sections, attributes, and forms

Authoritative Sources

This skill uses the following authoritative sources for DWARF standard information:

dwarfstd.org: Official DWARF specification (via web search)
LLVM source: llvm/lib/DebugInfo/DWARF/ for reference implementations
libdwarf source: github.com/davea42/libdwarf-code for C implementations

Installation

/plugin install trailofbits/skills/plugins/dwarf-expert