Plugin

Sharp Edges

Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes

Type: Plugin
Repository: trailofbits/skills
GitHub stars: 7.3k
License: CC-BY-SA-4.0
Repo last updated: Sep 25, 2026
Source file: plugins/sharp-edges/.claude-plugin/plugin.json
Version: 1.1.3
Author: Trail of Bits

What Sharp Edges is

Sharp Edges is a plugin published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”

A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.

Installing Sharp Edges adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.

How to install Sharp Edges

Claude Code

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills
Install the plugin: claude plugin install sharp-edges@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
Restart the session if the new skills or commands don't appear straight away.

Claude Cowork

Open Customize → Plugins and choose Add marketplace.
Enter trailofbits/skills (the owner/repo shorthand works for GitHub).
Find Sharp Edges in the list, click Install, then connect any connectors it needs from its Connectors tab.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/sharp-edges/.claude-plugin/plugin.json, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes through developer confusion, laziness, or malice.

When to Use

Reviewing API designs for security-relevant interfaces
Auditing configuration schemas that expose security choices
Evaluating cryptographic library ergonomics
Assessing authentication/authorization APIs
Any code review where developers make security-critical decisions

What It Does

Analyzes code and designs through the lens of three adversaries:

The Scoundrel: Can a malicious developer or attacker disable security via configuration?
The Lazy Developer: Will copy-pasting the first example lead to insecure code?
The Confused Developer: Can parameters be swapped without type errors?

Core Principle

The pit of success: Secure usage should be the path of least resistance. If developers must read documentation carefully or remember special rules to avoid vulnerabilities, the API has failed.

Installation

/plugin install trailofbits/skills/plugins/sharp-edges

Sharp Edge Categories

The skill identifies six categories of misuse-prone designs:

Agent

The sharp-edges-analyzer agent runs the full analysis workflow autonomously in a subagent context. Use it when you want a dedicated, isolated analysis of APIs, configurations, or interfaces for misuse resistance.

Related Skills

constant-time-analysis - Detect timing side-channels in cryptographic code
differential-review - Security-focused code change review
audit-context-building - Deep architectural analysis before auditing

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Sharp Edges?

Sharp Edges is a plugin for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Identify error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes

How do I install Sharp Edges in Claude Code?

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills Install the plugin: claude plugin install sharp-edges@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.

Can I use Sharp Edges in Claude Cowork?

Open Customize → Plugins and choose Add marketplace. Enter trailofbits/skills (the owner/repo shorthand works for GitHub). Find Sharp Edges in the list, click Install, then connect any connectors it needs from its Connectors tab.

Is Sharp Edges safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under CC-BY-SA-4.0. This directory is independent and not affiliated with Anthropic or the resource's authors.