Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sickn33/sharp-edges
sharp-edges
Passed 19 of 22 test cases with the skill, and 17 of 22 without it.
and 2 more in the full report
3 fixed16 passed either way2 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Can you review our PHP backend service constructor and configuration options for managing user password hashes and API sessions? ```php class SecurityManager { public function __construct( public string $hashAlgo = 'sha256', public int $sessionTimeout = 3600, public bool $bypassAuthForHealth = false ) {} } ``` Audit this configuration schema for security risks where incorrect options or bad caller inputs could break security unnoticed. Return your findings as a categorized vulnerability report that explains the misuse scenarios and rates the risk level for each design flaw.
| Checked | Without skill | With skill |
|---|---|---|
| Identify that allowing unvalidated string input for hashAlgo permits selection of weak hash algorithms. | Missed | Passed |
| Identify that sessionTimeout lacks validation for zero or negative values. | Missed | Passed |
| Classify the unvalidated hash algorithm option as High severity. | Missed | Passed |
The instructions your model reads when the skill loads.
Evaluates whether APIs, configurations, and interfaces are resistant to developer misuse. Identifies designs where the "easy path" leads to insecurity.
The pit of success: Secure usage should be the path of least resistance. If developers must understand cryptography, read documentation carefully, or remember special rules to avoid vulnerabilities, the API has failed.
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "It's documented" | Developers don't read docs under deadline pressure | Make the secure choice the default or only option |
| "Advanced users need flexibility" | Flexibility creates footguns; most "advanced" usage is copy-paste | Provide safe high-level APIs; hide primitives |
| "It's the developer's responsibility" | Blame-shifting; you designed the footgun | Remove the footgun or make it impossible to misuse |
| "Nobody would actually do that" | Developers do everything imaginable under pressure | Assume maximum developer confusion |
| "It's just a configuration option" | Config is code; wrong configs ship to production | Validate configs; reject dangerous combinations |
| "We need backwards compatibility" | Insecure defaults can't be grandfather-claused | Deprecate loudly; force migration |
APIs that let developers choose algorithms invite choosing wrong ones.
The JWT Pattern (canonical example):
"alg": "none" to bypass signaturestest cases passed, vs 17 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.