skills.rest
TECH-HY
TECH-HYOFFICIAL
Explore all skills by this author →
GitHub

sharp-edges

Identifies error-prone APIs, dangerous configurations, and misuse-prone designs that enable security mistakes.

Updated Mar 22, 2026
Search Tags:#api design#security review#cryptography#configuration audit#secure defaults#footgun detection#misuse resistance
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill sharp-edges-tech-hy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sharp-edges
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/sharp-edges
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill sharp-edges-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? APIs, configuration schemas, and cryptographic interfaces often contain design flaws where the easy path leads to insecurity—algorithm selection footguns, dangerous defaults, silent failures, and type confusion. This Skill systematically reviews code and configurations to find these "sharp edges" before they become vulnerabilities. ## Core Features & Use Cases - Footgun Detection: Identifies algorithm/mode selection parameters, dangerous defaults, zero/empty/null semantic traps, and configuration cliffs across APIs and config schemas. - Adversary-Based Threat Modeling: Evaluates designs against three attacker personas—the Scoundrel, the Lazy Developer, and the Confused Developer—to surface realistic misuse scenarios. - Language-Specific References: Includes detailed footgun guides for C/C++, Go, Rust, Java, Kotlin, C#, PHP, JavaScript/TypeScript, Python, Ruby, and Swift, plus real-world case studies (OpenSSL, GMP, pickle, YAML). - Use Case: When reviewing a new authentication library, use this Skill to check whether OTP lifetime parameters accept zero, whether password comparison is timing-safe, and whether constructor parameters are validated rather than merely defaulted. ## Quick Start Review this API design and configuration schema for security footguns, dangerous defaults, and misuse-prone patterns using the sharp edges analysis workflow.

Frequently Asked Questions about sharp-edges

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review an API design for security footguns?▼

Map security-relevant surfaces like authentication, cryptography, and configuration, then probe each choice point with zero, empty, null, and negative values. Check whether defaults are secure, whether algorithm selection is exposed to callers, and whether errors fail silently instead of throwing.

What is a sharp edge or footgun in API design?▼

A sharp edge is a design where the easy or obvious usage path leads to insecurity, such as JWT libraries trusting the alg header, timeout parameters where zero disables expiry, or byte-array parameters that allow swapping keys and nonces without type errors.

How do I detect dangerous configuration options in code?▼

Look for booleans that disable security controls, numeric parameters accepting zero or negative values with undefined semantics, string configs accepting wildcards, and constructor parameters with secure defaults but no validation against insecure caller overrides.

When should I not use sharp edges analysis?▼

This analysis targets design-level misuse resistance, not implementation bugs or business logic flaws. Use standard code review for implementation defects and domain-specific analysis for business logic; use this approach only for API ergonomics and configuration safety.

Does this cover language-specific security pitfalls?▼

Yes, reference guides cover footguns in C/C++, Go, Rust, Java, Kotlin, C#, PHP, JavaScript/TypeScript, Python, Ruby, and Swift, including issues like Go slice aliasing, PHP type juggling, Java deserialization, and JavaScript prototype pollution.

Related Skills

Explore More Software Engineering Skills→
ayehiaaayehiaa

sharp-edges

Identify developer-misuse-prone security footguns in API designs and configurations.

Community
Advanced
solo-istsolo-ist
2

review-feedback

Analyze GitHub PR feedback to validate issues and generate structured recommendations.

Official
Advanced
rabbicserabbicse

security-reviewer

Identify security vulnerabilities in code, dependencies, secrets, and infrastructure.

Community
Advanced
kay6198835kay6198835

design-review

Automates evaluation of game design documents for completeness, consistency, and implementability.

Community
Advanced