sharp-edges
Identify dangerous API footguns, surprising default behaviors, and sharp edges in codebases and dependencies. Adapted from Trail of Bits. Use during code review to catch APIs that are easy to misuse, configurations that surprise, and abstractions that leak.
npx skills add vibeeval/vibecosystem --skill sharp-edges --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Sharp Edges Detection Sharp edges are APIs, configurations, and patterns that are easy to use incorrectly. They work in the happy path but break in subtle, dangerous ways. ## Three Adversary Types When evaluating sharp edges, consider three types of users: ### 1. The Naive Developer - Uses the API without reading docs carefully - Copies examples from Stack Overflow - Assumes defaults are safe - **Question**: "Will this API hurt someone who doesn't know its quirks?" ### 2. The Malicious User - Intentionally sends unexpected input - Exploits race conditions and edge cases - Chains small issues into big exploits - **Question**: "Can someone deliberately trigger the bad behavior?" ### 3. The Future Maintainer - Modifies code without full context - Refactors without understanding invariants - Doesn't know why something was done a certain way - **Question**: "Will a reasonable change to this code introduce a bug?" ## Sharp Edge Categories ### 1. Surprising Default Behavior APIs whose defaults do something unexpected: ```typescript // SHARP: parseInt without radix parseInt("08") // 0 in old engines (octal), 8 in modern parseInt("08", 10) // Always 8 // SHARP: Array.sort() without compar
- Three Adversary Types
- 1. The Naive Developer
- 2. The Malicious User
- 3. The Future Maintainer
- Sharp Edge Categories
- 1. Surprising Default Behavior
- 2. Silent Failures
- 3. Type Coercion Traps
- 4. Concurrency Sharp Edges
- 5. Security Sharp Edges
- 6. Database Sharp Edges
- 7. Framework Sharp Edges
- Detection Checklist
- Documentation Pattern
What does the sharp-edges skill do?
Identify dangerous API footguns, surprising default behaviors, and sharp edges in codebases and dependencies. Adapted from Trail of Bits. Use during code review to catch APIs that are easy to misuse, configurations that surprise, and abstractions that leak.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill sharp-edges --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.