sharp-edges

The sharp-edges skill is designed to help developers and security professionals identify APIs, configuration schemas, and interface designs that are prone to misuse and security mistakes. It targets areas where the 'easy path' for developers inadvertently introduces vulnerabilities, such as insecure defaults, improper cryptographic algorithm choices, or configurations that allow dangerous options. By evaluating code and systems for footguns and other risky design patterns, it ensures that secure practices are the path of least resistance, following the 'pit of success' principle where safe usage is the default outcome.

This skill provides several key capabilities, including detecting algorithm and mode selection footguns, recognizing dangerous default values, and assessing cryptographic API ergonomics. It can identify parameters or configuration options that could lead developers to insecure choices, highlight places where documentation alone is insufficient to prevent mistakes, and provide guidance for redesigning APIs to be misuse-resistant. The autonomous agent, sharp-edges-analyzer, performs a structured four-phase analysis, encompassing surface identification, edge case probing, threat modeling, and validation of findings, allowing comprehensive evaluation across language-specific libraries and interfaces.

Sharp-edges is primarily intended for code reviewers, security auditors, and developers designing libraries or APIs with security implications. It is useful when reviewing API design decisions, auditing configuration schemas, assessing cryptography and authentication interfaces, or any situation where the interface exposes security-relevant decisions to users. However, it is not meant for detecting implementation bugs, business logic flaws, or performance optimizations, as these require separate analysis approaches.