sharp-edges

Name: sharp-edges
Availability: InStock
Author: ayehiaa

Identify developer-misuse-prone security footguns in API designs and configurations.

Updated May 2, 2026

Search Tags:#code review #threat modeling #security review #configuration validation #secure defaults #misuse resistance #cryptography API design

Ready to run

npx skills add https://github.com/ayehiaa/my-travel-assistant --skill sharp-edges-ayehiaa

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sharp-edges
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/sharp-edges
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill sharp-edges-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you identify API designs and configurations that are easy to misuse, where the insecure path is the default path, preventing avoidable security failures.

Core Features & Use Cases

Misuse-Resistance Review: Evaluates whether developer choice points (algorithms, modes, timeouts, keys, flags) lead users into insecure outcomes.
Sharp-Edge Discovery & Validation: Runs a structured workflow to surface candidate footguns, probes edge cases (zero/empty/null/negative and type confusion), and validates whether findings are exploitable.
Security-Architecture Threat Modeling: Assesses impact across adversaries such as a malicious config/controller, a lazy copy-paster, and a confused developer.

Quick Start

Ask an AI reviewer to run sharp-edges analysis on your authentication and cryptography API design, focusing on insecure defaults, algorithm/mode selection, config validation, and silent failure paths.

Frequently Asked Questions about sharp-edges

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find security footguns in an API design before shipping?▼

To find security footguns in an API design, you need a misuse-resistance review that evaluates developer choice points like algorithms, modes, timeouts, and flags to identify where the insecure path becomes the default outcome.

What is misuse resistance in cryptography API design?▼

Misuse resistance in cryptography API design is the practice of structuring developer choice points so that default selections and common copy-paste patterns lead to secure outcomes rather than silent failures or exploitable vulnerabilities.

How do I validate configuration schema security for silent failure paths?▼

Validating configuration schema security requires probing edge cases like zero, empty, null, and negative values to discover silent failure paths and confirm whether attacker misuse paths are actually exploitable with reproducible evidence.

Can threat modeling help assess the impact of insecure defaults on developers?▼

Threat modeling can assess the impact of insecure defaults by simulating adversaries such as a malicious config controller, a lazy copy-paster, and a confused developer to model potential attacker misuse paths.

What is the best way to review authentication APIs for insecure-by-default outcomes?▼

The best way to review authentication APIs for insecure-by-default outcomes is running a structured security analysis that surfaces choice points, probes edge cases, and validates findings with reproducible evidence to prevent avoidable failures.

When do I need a structured security review for my API choice points?▼

You need a structured security review for your API choice points when your design involves authentication, authorization, or cryptography ergonomics, ensuring that default developer paths do not lead to avoidable security failures.