Skip to main content
affpapa.org
RU EN
skill CX Codex

constant-time-testing — Claude Code skill: testing and setup

This skill helps test whether a cryptographic implementation’s runtime varies with secret data. Use it when auditing crypto code or investigating a possible timing leak.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill constant-time-testing -a claude-code
Open on GitHub

What constant-time-testing does

The skill focuses on measurements from running cryptographic code. It covers statistical timing tests and runtime tracing, then explains how formal, symbolic, dynamic, and statistical approaches differ. This is execution-time analysis, not a static inspection of compiler output.

The guide discusses branches driven by secrets, array lookups, division, and shifts as potential sources of timing variation. Statistical results can be affected by noise and do not identify the cause on their own, so interpretation matters. The material is aimed at cryptographic code that handles secret values.

What it helps with

  • test whether runtime varies with secret inputs
  • measure timing variation in a compiled crypto binary
  • investigate a suspected timing leak in cryptographic code
  • interpret results from runtime or statistical analysis

Example prompts for the agent

  • Check whether this cryptographic implementation’s runtime depends on its secret key.
  • Measure timing variation in the compiled version of this cryptographic function.
  • Investigate whether a branch on secret data could reveal information through runtime differences.

How to install constant-time-testing

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill constant-time-testing -a claude-code

2Manually: put the files in place

~/.claude/skills/constant-time-testing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/constant-time-testing/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about constant-time-testing

How do I install constant-time-testing in Claude Code?

Run npx skills add trailofbits/skills --skill constant-time-testing -a claude-code. The skill file is located at ~/.claude/skills/constant-time-testing/SKILL.md.

What does constant-time-testing do?

It helps investigate timing leaks in running cryptographic code through statistical measurements and dynamic analysis. It also explains how to interpret results from different analysis approaches.

Can this skill inspect compiler output without running the program?

No. Its focus is runtime behavior and timing measurements; static inspection of compiled output is handled by a different tool.

Similar skills

All skills for Testing and QA →
improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. 1,163,035installs design-taste-frontend Leonxlnx This skill directs the design of public pages and work screens, then checks the result in a browser through screenshots. Use it when an interface feels generic or unfinished. CX Codex +1 678,700installs tdd Matt Pocock Guides the red-green TDD loop: ensures tests are written first, keep them at public interfaces, and avoid coupling to implementation details. 1,141,062installs skill-creator official anthropics Creates and refines skills, then tests them with prompts, evaluations, and performance checks. 414,180installs agent-browser vercel-labs A CLI skill for browser control: it opens pages, fills forms, clicks buttons, and tests web apps. Use it when an agent needs to act inside a website. CX Codex +1 1,200,000installs prototype Matt Pocock Creates throwaway prototypes for checking state logic or exploring UI before committing the decision to the main codebase. 986,201installs

From the same set77

substrate-vulnerability-scanner Scans Substrate and Polkadot pallets for 7 critical vulnerabilities such as panic DoS and integer overflow. Useful when auditing FRAME runtimes before mainnet launch. CX Codex +1 5,200installs atheris Guides setup of coverage-guided fuzzing for Python code and C extensions with Atheris. Use it to investigate crashes and memory corruption. CX Codex +1 5,200installs ossfuzz Guides your AI agent through enrolling projects in Google OSS-Fuzz and running fuzzer targets locally with helper scripts. CX Codex +1 5,200installs devcontainer-setup Creates a sandboxed devcontainer with Claude Code, persistent volumes, and tooling for Python, Node, Rust, or Go. Helpful when setting up isolated development workspaces. CX Codex +1 5,200installs algorand-vulnerability-scanner Checks Algorand contracts written in TEAL or PyTeal against 11 known vulnerability patterns, from rekeying to unprotected admin calls. CX Codex +1 5,200installs dwarf-expert Inspects DWARF debug sections in compiled binaries, verifies DIE trees, and assists with parsers. Handy when analyzing compiled code. CX Codex +1 5,200installs libfuzzer A skill that walks the agent through libFuzzer: the harness, the -fsanitize=fuzzer build, corpus handling, campaign triage. For C/C++ built with Clang. CX Codex +1 5,200installs testing-handbook-generator Turns Trail of Bits Testing Handbook pages into Claude skills, picking a template per section type and writing the SKILL.md files for you. CX Codex +1 5,200installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor