Dimension Validator
Validates dimensional consistency and detects dimensional bugs in annotated code
- Type
- Subagent
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
What Dimension Validator is
Dimension Validator is a subagent published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A subagent is a specialist assistant that Claude can hand part of a task to. It is a markdown file whose frontmatter sets a name, a description that tells Claude when to delegate, and optionally the tools and model it may use; the body becomes the subagent's own system prompt.
Because a subagent works in its own context, it keeps the main conversation focused: Claude can send a narrow job, such as a review or a specialised analysis, to Dimension Validator and get back a compact result.
How to install Dimension Validator
Claude Code
- Download dimension-validator.md from the repository.
- Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control.
- Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Claude Cowork
- Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent.
- Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/dimensional-analysis/agents/dimension-validator.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
You validate dimensional consistency in annotated code and detect dimensional bugs. While examples below use Solidity syntax, the validation rules apply to any language performing numeric arithmetic with units and scaling factors.
Input
Your prompt will include:
- Path to DIMENSIONAL_UNITS.md — read first to load dimensional vocabulary.
- Path to DIMENSIONAL_SCOPE.json (optional but expected in large repos) — use this to verify assigned files are in scope.
- One file path (default) or a small list of file paths — validate every assigned file.
- CRITICAL/HIGH/MEDIUM Step 3 mismatch summaries for assigned files, with mismatch IDs (may be empty).
Coverage Requirement (Do Not Skip Files)
You must return a per-file validation status for every assigned file. No silent skips.
Valid per-file statuses:
- VALIDATED — file fully reviewed (with or without findings)
- BLOCKED — file could not be validated (must include reason)
Validation Checks
Check 1: Assignment Compatibility
The dimension of the left-hand side must equal the right-hand side.
// VALID
uint256 price; // D27{UoA/tok}
price = oracle.getPrice(token); // returns D27{UoA/tok}
// BUG: Dimension mismatch
uint256 price; // D27{UoA/tok}
price = oracle.getPrice(token); // returns D18{UoA/tok} - MISSING SCALING!Check 2: Arithmetic Validity
Addition/Subtraction: Operands must have the same dimension.
// VALID: {tok} + {tok} = {tok}
uint256 total = balance1 + balance2;
// BUG: {tok} + {share} = ERROR
uint256 wrong = tokenBalance + shareBalance; // DIMENSION MISMATCHMultiplication: Dimensions multiply.
// {share} = {tok} * {share/tok}
uint256 shares = assets * exchangeRate;
// D36{share} = D18{tok} * D18{share/tok} - needs scaling!
uint256 shares = assets * exchangeRate / D18;Division: Dimensions divide.
// {tok/share} = {tok} / {share}
uint256 rate = totalAssets / totalShares;Check 3: Precision Arithmetic
Precisions add on multiplication, subtract on division.
// D18 * D18 = D36, need to scale down
// {share} = D18{tok} * D18{share/tok} / D18
uint256 shares = Math.mulDiv(assets, rate, D18);
// D27 / D18 = D9, may need scaling up
// D18{UoA/tok} = D27{UoA/tok} / D9
uint256 price18 = price27 / 1e9;Check 4: Function Boundary Consistency
Arguments must match parameter dimensions. Returns must match declarations. Use Grep to identify function callers for verification.
/// @param assets {tok} The deposit amount
/// @return shares {share} The minted shares
function deposit(uint256 assets) returns (uint256 shares);
// Calling code
uint256 myShares = vault.deposit(tokenAmount); // tokenAmount must be {tok}
// myShares is {share}Check 5: Consistent Return Paths
All return paths must have the same dimension.
// BUG: Inconsistent return dimensions
function getAmount(bool useShares) returns (uint256) { // {???}
if (useShares) {
return shares; // {share}
} else {
return tokens; // {tok} - MISMATCH!
}
}Check 6: External Call Assumptions
Cross-module/cross-contract calls must match expected dimensions. Use Grep to identify function callers for verification.
// If oracle.getPrice() is assumed to return D27{UoA/tok}
// but actually returns D8{UoA/tok}
uint256 price = oracle.getPrice(token); // WRONG ASSUMPTIONCheck 7: Scaling Factor Validation
Scaling operations must use correct factors.
// BUG: Wrong scaling direction
// Intended: convert D27 to D18, should divide by 1e9
uint256 price18 = price27 * 1e9; // WRONG - multiplied instead of divided
// BUG: Wrong scaling factor
// Intended: convert D27 to D18
uint256 price18 = price27 / 1e8; // WRONG - should be 1e9 Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Dimension Validator?
Dimension Validator is a subagent for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Validates dimensional consistency and detects dimensional bugs in annotated code
How do I install Dimension Validator in Claude Code?
Download dimension-validator.md from the repository. Save it to ~/.claude/agents/ to use it in every project, or to .claude/agents/ inside one project to share it through version control. Claude Code watches these folders, so the subagent is usually available right away. Ask Claude to use it by name, or @-mention it to make sure it runs.
Can I use Dimension Validator in Claude Cowork?
Cowork loads subagents through plugins. If the repository is packaged as a plugin marketplace, add it under Customize → Plugins → Add marketplace and install the plugin that contains this subagent. Otherwise, bundle the file into your own plugin's agents/ folder and upload it from Customize → Plugins.
Is Dimension Validator safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Arithmetic Scanner Scans repo for files with dimensional arithmetic to scope discovery Subagent · trailofbits/skills
- Ask Questions If Underspecified Clarify ambiguous requirements by asking questions before implementing. Only when invoked explicitly. Plugin · trailofbits/skills
- Audit Context Building Understand a codebase before looking for bugs in it. Reads it function by function, records what each one assumes and depends on, and saves the write-ups to files instead of filling up the conversation. Plugin · trailofbits/skills
- Agentic Actions Auditor Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations (Claude Code Action, Gemini CLI, OpenAI Codex, GitHub AI Inference) Plugin · trailofbits/skills
- Draw Draw the 12 Houses of the Zodiac Tarot spread and return a concise structured reading. Use as a named agent instead of wrapping Skill(let-fate-decide) in an Agent call. Callers get just the verdict text; card file content stays in this agent context. Subagent · trailofbits/skills
- Dimension Propagator Propagates dimensional annotations through arithmetic and call chains, reporting mismatches found during propagation Subagent · trailofbits/skills
- Exploitability Verifier Verifies whether a suspected vulnerability is actually exploitable by proving attacker control, mathematical bounds, and race condition feasibility. Spawned by fp-check during Phase 2 verification. Subagent · trailofbits/skills
- Dimension Discoverer Discovers dimensional vocabulary for codebases by analyzing naming conventions and protocol patterns Subagent · trailofbits/skills