# genotoxic

Sorts survived mutants into false positives, missing unit tests and fuzzing targets, using a code graph built with Trailmark.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3800 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/genotoxic/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/genotoxic

## What it does

genotoxic runs three phases. First it parses the target with Trailmark and calls `engine.preanalysis()` — that step is mandatory, because triage later leans on blast radius, entry points and taint data. Then comes the mutation framework for your language. Finally the findings get classified into four buckets: corroborated by both tools, harmless, needs a unit test, or needs a fuzz harness.

Trailmark has to be there before anything else. If `uv run trailmark` fails, install it with `uv tool install trailmark` rather than falling back to reading the code by hand. You also need a mutation framework for the target language and a test suite that currently passes. necessist is optional and worth adding: it strips statements from tests to expose assertions that never fail. Install it with `cargo install necessist`; it covers Go, Rust, Solidity/Foundry, TypeScript/Hardhat, TypeScript/Vitest and Rust/Anchor.

On macOS, run `ulimit -n 1024` before every `mull-runner` call. Tahoe (26+) leaves file descriptors unlimited by default, and Mull crashes when it spawns subprocesses. A project with no test suite at all is the wrong place to start — there is nothing for the mutants to survive against.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill genotoxic -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/genotoxic/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/genotoxic/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill genotoxic -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/genotoxic/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill genotoxic -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/genotoxic/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills genotoxic
```

2. **Manually: put the files in place**
- File: `.github/skills/genotoxic/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill genotoxic -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/trailmark/skills/genotoxic
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/genotoxic/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill genotoxic -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/genotoxic/SKILL.md

## When to use it
- separate harmless survived mutants from ones that point at real gaps
- spot functions that want a fuzz harness instead of more unit tests
- strip test statements that assert nothing useful
- rank test work by data flow context
- flag mutants sitting in dead code for removal

## Example prompts
- Run mutation testing over `src/` and triage the survived mutants with genotoxic
- Build the Trailmark code graph and show where unit tests would pay off most
- Run necessist and list the unnecessary statements in the test suite

## Similar
- [improve-codebase-architecture](https://affpapa.org/en/nevibecode/skills/improve-codebase-architecture.md) — skill · 1163035 installs
- [design-taste-frontend](https://affpapa.org/en/nevibecode/skills/design-taste-frontend.md) — skill · 678700 installs
- [tdd](https://affpapa.org/en/nevibecode/skills/tdd.md) — skill · 1141062 installs
- [skill-creator](https://affpapa.org/en/nevibecode/skills/skill-creator.md) — skill · 414180 installs
- [agent-browser](https://affpapa.org/en/nevibecode/skills/vercel-labs-agent-browser.md) — skill · 1200000 installs
- [prototype](https://affpapa.org/en/nevibecode/skills/prototype.md) — skill · 986201 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md