Agent skill · Trail of Bits
Constant-Time Analysis skill for Claude Code, Codex and Cursor
Officialname: constant-time-analysis★ 7.8k (repo)pushed 2026-10-24CC-BY-SA-4.0SKILL.md on GitHubchecked 2026-11-07
What it does, in the publisher's words
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.
Install Constant-Time Analysis
The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs
npx skills add trailofbits/skills --skill constant-time-analysis
This repo is a plugin marketplace. Inside Claude Code, add it and install the plugin that holds the skill (audit-context-building, building-secure-contracts, burpsuite-project-parser, chrome-mcp-troubleshooting...), or copy only this skill into ~/.claude/skills. docs
/plugin marketplace add trailofbits/skills /plugin install <plugin>@trailofbits # or only this skill: npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code
Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs
git clone --depth 1 https://github.com/trailofbits/skills.git /tmp/constant-time-analysis-src cp -r /tmp/constant-time-analysis-src/plugins/constant-time-analysis/skills/constant-time-analysis ./constant-time-analysis zip -r constant-time-analysis.zip constant-time-analysis
Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs
npx skills add trailofbits/skills --skill constant-time-analysis -a codex
gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs
gh skill install trailofbits/skills constant-time-analysis
Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs
npx skills add trailofbits/skills --skill constant-time-analysis -a cursor
Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs
gemini skills install https://github.com/trailofbits/skills.git --path plugins/constant-time-analysis/skills/constant-time-analysis
OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs
npx skills add trailofbits/skills --skill constant-time-analysis -a opencode
Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs
npx skills add trailofbits/skills --skill constant-time-analysis -a windsurf
Works with
Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.
- Uses effort in its frontmatter: Claude Code extensions to the Agent Skills format. Other agents load the skill but may not honor that field.
- Pre-approves these tools (allowed-tools, experimental in the spec): Bash Read Grep Glob.
What's in the SKILL.md
- When to Use
- When NOT to Use
- Language Routing
- Running the Analyzer
- Per-language coverage limits
- Prerequisites
- Interpreting Results
- Triaging Findings
- Limitations
- Real-World Impact
- References
Bundled files
- README.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/compiled.md
- references/javascript.md
- references/kotlin.md
- references/php.md
- references/python.md
- references/ruby.md
- references/swift.md
- references/vm-compiled.md
Loaded only when the instructions point to them.
Facts
- Skill name
- constant-time-analysis
- Publisher
- Trail of Bits (official)
- Repo
- trailofbits/skills
- License
- CC-BY-SA-4.0
- SKILL.md size
- 1,839 words, 179 lines
- Bundled files
- 11, 9 docs
- Repo stars
- 7.8k (as of 2026-10-24)
- SKILL.md checked
- 2026-11-07
More skills from trailofbits/skills
- Agentic Actions Auditor: Audits GitHub Actions workflows that run AI agents for prompt-injection and privilege risks.
- CodeQL Scan: Builds a CodeQL database and runs data-flow and taint analysis to find vulnerabilities.
- Differential Security Review: Security review of a diff that weighs blast radius, call sites and test coverage of changed code.
- Modern Python Tooling: Sets up Python projects with uv, ruff and ty, or migrates from pip, Poetry and mypy.
- Property-Based Testing: Writes and debugs property-based tests with Hypothesis, fast-check, proptest and similar tools.
- Semgrep Rule Creator: Writes custom Semgrep rules to catch specific bug or vulnerability patterns.
- Sharp Edges: Flags error-prone APIs, risky defaults and footgun designs that invite security mistakes.
Related security & auth skills
- Security Best Practices Review · OpenAI
- Security Threat Model · OpenAI
- Sign In With Google (Web) · Google
- Security Review (Sentry) · Sentry
- Firebase Security Rules Auditor · Firebase (Google)
- Better Auth Best Practices · Better Auth
- Create Auth (Better Auth) · Better Auth
- Clerk Next.js Patterns · Clerk
FAQ
What does the constant-time-analysis skill do?+
Finds timing side channels in cryptographic code, such as branches on secret values. In its own SKILL.md, Trail of Bits describes it as: "Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python,..."
How do I install the constant-time-analysis skill?+
Run npx skills add trailofbits/skills --skill constant-time-analysis and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/constant-time-analysis/SKILL.md; in Codex and Cursor in .agents/skills/constant-time-analysis/.
Does Constant-Time Analysis work in Codex, Cursor and Copilot, or only Claude?+
It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more. It also sets effort, which are Claude Code extensions; other agents may ignore it.
Who maintains Constant-Time Analysis?+
Trail of Bits, the company or project behind it, in the trailofbits/skills repo on GitHub, last pushed 2026-10-24. License: CC-BY-SA-4.0.
Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers