sharp-edges
💡 Summary
Sharp Edges identifies error-prone APIs and configurations to prevent security mistakes.
🎯 Target Audience
🤖 AI Roast: “This skill is like a safety net for developers who forgot to read the manual.”
The skill analyzes code for security vulnerabilities, which may expose sensitive information if misconfigured. To mitigate risks, ensure proper access controls and review configurations regularly.
Sharp Edges
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes through developer confusion, laziness, or malice.
When to Use
- Reviewing API designs for security-relevant interfaces
- Auditing configuration schemas that expose security choices
- Evaluating cryptographic library ergonomics
- Assessing authentication/authorization APIs
- Any code review where developers make security-critical decisions
What It Does
Analyzes code and designs through the lens of three adversaries:
- The Scoundrel: Can a malicious developer or attacker disable security via configuration?
- The Lazy Developer: Will copy-pasting the first example lead to insecure code?
- The Confused Developer: Can parameters be swapped without type errors?
Core Principle
The pit of success: Secure usage should be the path of least resistance. If developers must read documentation carefully or remember special rules to avoid vulnerabilities, the API has failed.
Installation
/plugin install trailofbits/skills/plugins/sharp-edges
Sharp Edge Categories
The skill identifies six categories of misuse-prone designs:
| Category | Example |
|----------|---------|
| Algorithm Selection | JWT alg: none attack; PHP hash("crc32", $password) |
| Dangerous Defaults | session_timeout: 0 meaning infinite; empty password accepted |
| Primitive vs. Semantic APIs | encrypt(msg, bytes, bytes) where key/nonce can be swapped |
| Configuration Cliffs | verify_ssl: false disables all certificate validation |
| Silent Failures | Verification returns False instead of throwing; ignored return values |
| Stringly-Typed Security | Permissions as comma-separated strings; SQL from concatenation |
Related Skills
- constant-time-analysis - Detect timing side-channels in cryptographic code
- differential-review - Security-focused code change review
- audit-context-building - Deep architectural analysis before auditing
Pros
- Helps identify security vulnerabilities early.
- Improves code quality and developer awareness.
- Supports multiple categories of security issues.
Cons
- May require deep understanding of security concepts.
- Could produce false positives in some cases.
Related Skills
constant-time-analysis
A“It's a Swiss Army knife for finding timing leaks, but you'll need a PhD in compiler toolchains to set up all the language backends.”
prowler
A“It's a Swiss Army knife for cloud security, but you'll need a PhD in YAML to configure all its moving parts.”
ethereum-wingman
A“Powerful, but the setup might scare off the impatient.”
Disclaimer: This content is sourced from GitHub open source projects for display and rating purposes only.
Copyright belongs to the original author trailofbits.