Plugin

Dwarf Expert

Analyze DWARF debug information: parse and search DIEs with dwarfdump and readelf, verify debug info integrity, and write DWARF parsing code

Type: Plugin
Repository: trailofbits/skills
GitHub stars: 7.3k
License: CC-BY-SA-4.0
Repo last updated: Sep 25, 2026
Source file: plugins/dwarf-expert/.claude-plugin/plugin.json
Version: 1.1.2
Author: Evan Hellman

What Dwarf Expert is

Dwarf Expert is a plugin published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”

A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.

Installing Dwarf Expert adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.

How to install Dwarf Expert

Claude Code

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills
Install the plugin: claude plugin install dwarf-expert@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
Restart the session if the new skills or commands don't appear straight away.

Claude Cowork

Open Customize → Plugins and choose Add marketplace.
Enter trailofbits/skills (the owner/repo shorthand works for GitHub).
Find Dwarf Expert in the list, click Install, then connect any connectors it needs from its Connectors tab.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/dwarf-expert/.claude-plugin/plugin.json, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.

Interact with and analyze DWARF debug information: parse and search DIEs with dwarfdump/llvm-dwarfdump and readelf, verify debug info integrity with llvm-dwarfdump --verify, answer questions about the DWARF standard, and write code that parses DWARF data.

Author: Evan Hellman

What It Does

The skill is a single SKILL.md covering:

Authoritative sources for standard questions: dwarfstd.org, LLVM's lib/DebugInfo/DWARF/, and libdwarf, looked up on demand rather than answered from memory
An llvm-dwarfdump flag reference for dumping, searching (--find, --name, --lookup), and displaying DIE trees
A search-escalation strategy: accelerator-table lookup, exhaustive name search, grep pipelines over full dumps, then a pyelftools script when pipelines turn brittle
Verification workflows: --verify (with --error-display and --verify-json) and --statistics for comparing debug-info quality across builds
Library recommendations for C/C++, Python, Rust, Go, and .NET, plus DWARF-specific pitfalls (optional attributes, DW_AT_abstract_origin / DW_AT_specification indirection, type chains)

Testing

tests/test_skill_contract.py extracts every llvm-dwarfdump flag the skill documents and checks it against the real tool's --help, and validates the frontmatter contract (name, description, effort, space-delimited allowed-tools). It fails if the extraction comes back empty or no LLVM dwarfdump is on PATH — a checker that inspects zero items must not pass.

Requires an LLVM dwarfdump that supports --error-display and --verify-json (upstream LLVM 19+; the test checks for the flags themselves rather than a version string, since Apple's LLVM numbering differs from upstream). macOS: current Xcode Command Line Tools qualify; Debian/Ubuntu: apt install llvm-19 or newer. Run with:

cd plugins/dwarf-expert/tests
uv run --no-project --with pytest python3 -m pytest -q --import-mode=importlib .

Installation

/plugin install trailofbits/skills/plugins/dwarf-expert

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Dwarf Expert?

Dwarf Expert is a plugin for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Analyze DWARF debug information: parse and search DIEs with dwarfdump and readelf, verify debug info integrity, and write DWARF parsing code

How do I install Dwarf Expert in Claude Code?

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills Install the plugin: claude plugin install dwarf-expert@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.

Can I use Dwarf Expert in Claude Cowork?

Open Customize → Plugins and choose Add marketplace. Enter trailofbits/skills (the owner/repo shorthand works for GitHub). Find Dwarf Expert in the list, click Install, then connect any connectors it needs from its Connectors tab.

Is Dwarf Expert safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under CC-BY-SA-4.0. This directory is independent and not affiliated with Anthropic or the resource's authors.