sharp-edges

仓库创建 2026年1月15日最近提交 10 小时前SkillHot 收录 21 天前

▸ 精选理由

帮助设计“默认安全”的接口，降低开发者误用带来的风险。

这个 Skill 做什么

识别 API、配置与接口中的易错设计与危险默认，评估是否易导致安全失误。

审查 API、配置或库设计时，找出那些“好用但容易出错”的陷阱和危险默认，评估是否会导致安全误用。常用在设计或评审认证、加密库、配置 schema 的场景。特色是从开发者易用性出发，强调 secure by default，避免把简单路径变成不安全选择。

▸ 展开 SKILL.md 英文原文

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.

开发编程设计评估易错点安全友好通用

6.3k

Stars

543

Forks

仓库内 Skill

+282

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/trailofbits/skills/main/plugins/sharp-edges/skills/sharp-edges/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/trailofbits/skills/main/plugins/sharp-edges/skills/sharp-edges/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Sharp Edges Analysis

Evaluates whether APIs, configurations, and interfaces are resistant to developer misuse. Identifies designs where the "easy path" leads to insecurity.

## When to Use

- Reviewing API or library design decisions
- Auditing configuration schemas for dangerous options
- Evaluating cryptographic API ergonomics
- Assessing authentication/authorization interfaces
- Reviewing any code that exposes security-relevant choices to developers

## When NOT to Use

- Implementation bugs (use standard code review)
- Business logic flaws (use domain-specific analysis)
- Performance optimization (different concern)

## Agent

The `sharp-edges-analyzer` agent runs the full sharp edges

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有