Arithmetic Scanner
Scans repo for files with dimensional arithmetic to scope discovery
- Type
- Subagent
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
What Arithmetic Scanner is
Arithmetic Scanner is a subagent published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Arithmetic Scanner and get back a compact result.
How to install Arithmetic Scanner
Claude Code
- Download arithmetic-scanner.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/dimensional-analysis/agents/arithmetic-scanner.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
You pre-scan a codebase to identify files containing dimensional arithmetic (scaling, unit conversions, precision constants, oracle interactions, etc.). Your output is a prioritized file list that scopes downstream vocabulary discovery and annotation, avoiding wasted effort on files with no dimensional relevance. When the prompt includes an output path for DIMENSIONAL_SCOPE.json, you must write the scope manifest to disk yourself.
Input
Your prompt may include:
- Project root path — the repository root to scan
- Absolute output path for DIMENSIONAL_SCOPE.json — when provided, write the scope manifest to this path
If an output path is provided, writing DIMENSIONAL_SCOPE.json is mandatory. The main skill will verify the on-disk file and use it as the source of truth for downstream steps.
Scanning Algorithm
Execute four passes in sequence. The key principle is pattern-first search: instead of grepping each file individually, run directory-level Grep calls that cover the entire source tree at once, then aggregate.
Pass 0: Source Inventory Baseline
Before pattern matching, inventory source files by language extension with Glob, applying the same path exclusions as Pass 1 (tests, dependencies, scripts, and mocks — see the post-filter table in Pass 1). Keep this baseline as all_source_files.
This baseline is required for coverage accounting in large repos:
- total_files_scanned must come from this inventory, not from grep matches.
- Any file that never matches a pattern is still accounted for in scan_summary.
- Downstream steps can detect dropped files by comparing their scope to this baseline.
Pass 1: Pattern-First Search
Run one Grep call per pattern group against the project root directory. Use these Grep parameters:
- output_mode: "count" — returns filepath:count pairs, giving both file discovery and hit counts in one call
- glob: ".sol" (or ".rs", "*.go", etc.) — filter to source files by extension
- path: the project root directory
For multi-language repos, run one set of Grep calls per language extension using the glob parameter. For single-language repos, one set is sufficient.
Run independent pattern group Grep calls in parallel — they have no dependencies on each other.
Required Pagination (Large Repo Safety)
Never assume a single Grep response is complete for a pattern group.
For each pattern-group Grep query:
- Use explicit pagination (head_limit + offset) and collect all pages.
- Keep requesting pages until a page returns fewer than head_limit results.
- If the tool indicates truncation (for example, output says "at least ..."), continue paging until exhaustion.
- Merge all pages before scoring.
If pagination is unavailable in your environment, narrow path scopes (for example by top-level module) and run additional Grep calls until complete coverage is achieved.
After collecting results, post-filter excluded paths by dropping any result whose path contains any of these segments:
Do not blindly exclude every /lib/ path. Many projects keep first-party source in src/lib or lib/. Exclude a lib/ subtree only when it is clearly vendored dependency code.
High-Signal Pattern Groups
Combine related patterns into regex alternations. Each row is one Grep call:
Medium-Signal Pattern Groups
This totals ~14 Grep calls (or fewer if some groups can be merged), regardless of whether the repo has 50 or 500 source files.
Pass 2: Aggregate and Score
Aggregate the filepath:count results from Pass 1 into a per-file profile:
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Arithmetic Scanner?
Arithmetic Scanner is a subagent for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Scans repo for files with dimensional arithmetic to scope discovery
How do I install Arithmetic Scanner in Claude Code?
Download arithmetic-scanner.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Arithmetic Scanner in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Arithmetic Scanner safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Devcontainer Setup Create pre-configured devcontainers with Claude Code and language-specific tooling Plugin · trailofbits/skills
- Exploitability Verifier Verifies whether a suspected vulnerability is actually exploitable by proving attacker control, mathematical bounds, and race condition feasibility. Spawned by fp-check during Phase 2 verification. Subagent · trailofbits/skills
- Firebase Apk Scanner Scan Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. For authorized security research only. Plugin · trailofbits/skills
- Fp Check Systematic false positive verification for security bug analysis with mandatory gate reviews Plugin · trailofbits/skills
- C Review Dedup Judge Deduplication judge for the c-review pipeline. Merges duplicate findings deterministically by exact location and bug class, then runs LLM… Subagent · trailofbits/skills
- Adversarial Modeler Models attacker perspectives and builds exploit scenarios for HIGH RISK code changes. Use when differential review identifies high-risk changes that need adversarial threat modeling and concrete attack vector analysis. Subagent · trailofbits/skills
- C Review Fp Judge Second-stage judge in the c-review pipeline. Runs after dedup-judge on merged primaries only. Decides fp_verdict, then (for survivors)… Subagent · trailofbits/skills
- 6 Test Generator Generates runtime validation test harnesses (C tests, MSAN, Valgrind targets) for confirmed zeroize-audit findings. Produces a Makefile for automated test execution. Subagent · trailofbits/skills