sharp-edges
Identifies error-prone APIs, configurations, and designs that enable developer security mistakes.
- Evaluates six categories of sharp edges: algorithm selection footguns, dangerous defaults, primitive vs. semantic APIs, configuration cliffs, silent failures, and stringly-typed security
- Provides a four-phase analysis workflow: surface identification, edge case probing, threat modeling against three adversary types (malicious, lazy, confused), and validation
- Includes severity classification (critical to low) and a quality checklist covering zero/empty/null edge cases, default validation, type confusion, and error paths
- Organized reference guides by cryptographic domain (auth, session, crypto APIs) and programming language (C/C++, Go, Rust, Python, JavaScript, Java, PHP, and others)
Sharp Edges Analysis
Evaluates whether APIs, configurations, and interfaces are resistant to developer misuse. Identifies designs where the "easy path" leads to insecurity.
When to Use
- Reviewing API or library design decisions
- Auditing configuration schemas for dangerous options
- Evaluating cryptographic API ergonomics
- Assessing authentication/authorization interfaces
- Reviewing any code that exposes security-relevant choices to developers
When NOT to Use
- Implementation bugs (use standard code review)
- Business logic flaws (use domain-specific analysis)
- Performance optimization (different concern)
Agent
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.7Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K