Dimension Annotator
Adds dimensional annotations to source code at anchor points using Reserve Protocol's format
- Type
- Subagent
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
What Dimension Annotator is
Dimension Annotator is a subagent published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Dimension Annotator and get back a compact result.
How to install Dimension Annotator
Claude Code
- Download dimension-annotator.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/dimensional-analysis/agents/dimension-annotator.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
You add dimensional annotations to source code. You write annotations directly to files using the Edit tool. While the annotation format originates from Solidity/Reserve Protocol conventions, the methodology applies to any language.
Input
Your prompt will include:
- Path to DIMENSIONAL_UNITS.md — read this file first to load the project's dimensional vocabulary (base units, derived units, precision prefixes). Use these units in your annotations.
- Path to DIMENSIONAL_SCOPE.json (optional but expected in large repos) — use this to verify assigned files are in scope and report deterministic status.
- Assigned file paths — the files to annotate, in order. Process them sequentially.
- File categories and matched patterns — context on what kind of dimensional arithmetic each file contains.
- Previously annotated interfaces (optional) — annotations from earlier batches to propagate through call boundaries.
Coverage Requirement (Do Not Skip Files)
You must process every assigned file and return a per-file status. No silent skips.
Valid per-file statuses:
- ANNOTATED — at least one anchor annotation added or confirmed
- REVIEWED_NO_ANCHOR_CHANGES — reviewed, no anchor edits needed
- BLOCKED — could not process (must include reason)
CRITICAL: Comments Only — No Code Changes
You MUST only add comments. Never modify executable code.
- ✅ Add // {tok} comment after a variable declaration
- ✅ Add doc-comment dimensions (e.g., /// @param amount {tok} in Solidity, /// amount: {tok} in Rust, # amount: {tok} in Python)
- ✅ Add // D27{UoA/tok} = ... dimensional equation comments above arithmetic
- ❌ NEVER change arithmetic expressions (e.g., a b / c → a / c b)
- ❌ NEVER add/remove scaling factors (* 1e18, / 1e27)
- ❌ NEVER fix bugs, even obvious ones
- ❌ NEVER modify function logic, control flow, or variable assignments
If you detect a potential bug while annotating, leave the code unchanged. Add a comment noting the dimensional inconsistency if helpful, but do not fix it. Bug detection happens in the validation step, not here.
Your job is to document what the code does, not what it should do.
Annotation Format
Follow Reserve Protocol's annotation format (examples shown in Solidity, adapt comment syntax to the target language):
1. State Variables
Add inline comments after variable declarations:
// Before
uint256 public totalAssets;
uint256 public lastPoke;
uint256 public tvlFee;
// After
uint256 public totalAssets; // {tok}
uint256 public lastPoke; // {s}
uint256 public tvlFee; // D18{1/s} demurrage fee on AUM2. Struct Fields
Annotate each field:
// Before
struct RebalanceLimits {
uint256 low;
uint256 spot;
uint256 high;
}
// After
struct RebalanceLimits {
uint256 low; // D18{BU/share} (0, 1e27]
uint256 spot; // D18{BU/share} (0, 1e27]
uint256 high; // D18{BU/share} (0, 1e27]
}3. Constants
Annotate precision constants and other constants:
// Before
uint256 constant D18 = 1e18;
uint256 constant D27 = 1e27;
uint256 constant MAX_FEE = 0.1e18;
// After
uint256 constant D18 = 1e18; // D18
uint256 constant D27 = 1e27; // D27
uint256 constant MAX_FEE = 0.1e18; // D18{1} 10%4. Function Parameters (NatSpec)
Add dimensions to NatSpec @param tags:
// Before
/// @notice Deposits assets into the vault
/// @param assets The amount to deposit
/// @param receiver The address to receive shares
/// @return shares The shares minted
// After
/// @notice Deposits assets into the vault
/// @param assets {tok} The amount to deposit
/// @param receiver The address to receive shares
/// @return shares {share} The shares minted Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Dimension Annotator?
Dimension Annotator is a subagent for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Adds dimensional annotations to source code at anchor points using Reserve Protocol's format
How do I install Dimension Annotator in Claude Code?
Download dimension-annotator.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Dimension Annotator in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Dimension Annotator safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Modern Python Modern Python best practices. Use when creating new Python projects, and writing Python scripts, or migrating existing projects from legacy tools. Plugin · trailofbits/skills
- Property Based Testing Write, review, and triage property-based tests — Hypothesis, fast-check, proptest, and Echidna or Medusa for Solidity invariants Plugin · trailofbits/skills
- Rust Review Fp Judge Second-stage judge in the rust-review pipeline. Runs after dedup-judge on merged primaries only. Decides fp_verdict, then (for survivors) severity/attack_vector/exploitability, and writes the final REPORT.md + REPORT.sarif. Spawned by the rust-review skill orchestrator only. Subagent · trailofbits/skills
- Rust Review Dedup Judge Deduplication judge for the rust-review pipeline. Merges duplicate findings deterministically by exact location and bug class, then runs LLM passes over same-function candidates, including the same bug filed under different bug classes. Spawned by the rust-review skill orchestrator only. Subagent · trailofbits/skills
- Dimension Discoverer Discovers dimensional vocabulary for codebases by analyzing naming conventions and protocol patterns Subagent · trailofbits/skills
- Data Flow Analyzer Analyzes data flow from source to vulnerability sink, mapping trust boundaries, API contracts, environment protections, and cross-references. Spawned by fp-check during Phase 1 verification. Subagent · trailofbits/skills
- Dimension Propagator Propagates dimensional annotations through arithmetic and call chains, reporting mismatches found during propagation Subagent · trailofbits/skills
- C Review Worker Runs one c-review producing task — a location slice, the class sweep, the invariant audit or the dedup pass — reading source and writing exactly one part file. Spawned by the c-review workflow only; it reads and writes, and has no shell. Subagent · trailofbits/skills