Agent skill · Trail of Bits

Sharp Edges skill for Claude Code, Codex and Cursor

Flags error-prone APIs, risky defaults and footgun designs that invite security mistakes.

Officialname: sharp-edges★ 7.8k (repo)pushed 2026-10-24CC-BY-SA-4.0SKILL.md on GitHubchecked 2026-11-07

What it does, in the publisher's words

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.

The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.

Install Sharp Edges

The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs

npx skills add trailofbits/skills --skill sharp-edges

This repo is a plugin marketplace. Inside Claude Code, add it and install the plugin that holds the skill (audit-context-building, building-secure-contracts, burpsuite-project-parser, chrome-mcp-troubleshooting...), or copy only this skill into ~/.claude/skills. docs

/plugin marketplace add trailofbits/skills
/plugin install <plugin>@trailofbits

# or only this skill:
npx skills add trailofbits/skills --skill sharp-edges -a claude-code

Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs

git clone --depth 1 https://github.com/trailofbits/skills.git /tmp/sharp-edges-src
cp -r /tmp/sharp-edges-src/plugins/sharp-edges/skills/sharp-edges ./sharp-edges
zip -r sharp-edges.zip sharp-edges

Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs

npx skills add trailofbits/skills --skill sharp-edges -a codex

gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs

gh skill install trailofbits/skills sharp-edges

Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs

npx skills add trailofbits/skills --skill sharp-edges -a cursor

Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs

gemini skills install https://github.com/trailofbits/skills.git --path plugins/sharp-edges/skills/sharp-edges

OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs

npx skills add trailofbits/skills --skill sharp-edges -a opencode

Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs

npx skills add trailofbits/skills --skill sharp-edges -a windsurf

Works with

Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.

Pre-approves these tools (allowed-tools, experimental in the spec): Read Grep Glob.

What's in the SKILL.md

20 sections

When to Use
When NOT to Use
Agent
Core Principle
Rationalizations to Reject
Sharp Edge Categories
1. Algorithm/Mode Selection Footguns
2. Dangerous Defaults
3. Primitive vs. Semantic APIs
4. Configuration Cliffs
5. Silent Failures
6. Stringly-Typed Security
Analysis Workflow
Phase 1: Surface Identification
Phase 2: Edge Case Probing
Phase 3: Threat Modeling
Phase 4: Validate Findings
Severity Classification
References
Quality Checklist

Bundled files

agents/openai.yaml
assets/trail-of-bits-mark.svg
references/auth-patterns.md
references/case-studies.md
references/config-patterns.md
references/crypto-apis.md
references/lang-c.md
references/lang-csharp.md
references/lang-go.md
references/lang-java.md
references/lang-javascript.md
references/lang-kotlin.md
references/lang-php.md
references/lang-python.md
references/lang-ruby.md
references/lang-rust.md
references/lang-swift.md
references/language-specific.md

Loaded only when the instructions point to them.

Facts

Skill name: sharp-edges
Publisher: Trail of Bits (official)
Repo: trailofbits/skills
License: CC-BY-SA-4.0
SKILL.md size: 1,201 words, 288 lines
Bundled files: 18, 16 docs
Repo stars: 7.8k (as of 2026-10-24)
SKILL.md checked: 2026-11-07

More skills from trailofbits/skills

Agentic Actions Auditor: Audits GitHub Actions workflows that run AI agents for prompt-injection and privilege risks.
CodeQL Scan: Builds a CodeQL database and runs data-flow and taint analysis to find vulnerabilities.
Constant-Time Analysis: Finds timing side channels in cryptographic code, such as branches on secret values.
Differential Security Review: Security review of a diff that weighs blast radius, call sites and test coverage of changed code.
Modern Python Tooling: Sets up Python projects with uv, ruff and ty, or migrates from pip, Poetry and mypy.
Property-Based Testing: Writes and debugs property-based tests with Hypothesis, fast-check, proptest and similar tools.
Semgrep Rule Creator: Writes custom Semgrep rules to catch specific bug or vulnerability patterns.

Related security & auth skills

Security Best Practices Review · OpenAI
Security Threat Model · OpenAI
Sign In With Google (Web) · Google
Security Review (Sentry) · Sentry
Firebase Security Rules Auditor · Firebase (Google)
Better Auth Best Practices · Better Auth
Create Auth (Better Auth) · Better Auth
Clerk Next.js Patterns · Clerk

FAQ

What does the sharp-edges skill do?+

Flags error-prone APIs, risky defaults and footgun designs that invite security mistakes. In its own SKILL.md, Trail of Bits describes it as: "Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles."

How do I install the sharp-edges skill?+

Run npx skills add trailofbits/skills --skill sharp-edges and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/sharp-edges/SKILL.md; in Codex and Cursor in .agents/skills/sharp-edges/.

Does Sharp Edges work in Codex, Cursor and Copilot, or only Claude?+

It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.

Who maintains Sharp Edges?+

Trail of Bits, the company or project behind it, in the trailofbits/skills repo on GitHub, last pushed 2026-10-24. License: CC-BY-SA-4.0.

Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers