skill CX Codex

testing-handbook-generator — Claude Code skill: build skills

Q: How do I install testing-handbook-generator in Claude Code?

Run `npx skills add trailofbits/skills --skill testing-handbook-generator -a claude-code`. The skill lands at `~/.claude/skills/testing-handbook-generator/SKILL.md`.

Q: Does it need the handbook repository locally?

Yes. It checks `./testing-handbook`, `../testing-handbook` and `~/testing-handbook`. When nothing is found it asks you for the path, and clones `https://github.com/trailofbits/testing-handbook` only as a last resort.

Turns Trail of Bits Testing Handbook pages into Claude skills, picking a template per section type and writing the SKILL.md files for you.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add trailofbits/skills --skill testing-handbook-generator -a claude-code

Open on GitHub

What testing-handbook-generator does

Reach for this skill when you are building or refreshing a set of skills out of Testing Handbook material. It runs in five phases: locate the handbook repository, scan its sections and classify them (tool, fuzzer, technique, domain), produce a plan, generate the files, then validate them and update the README.

Generation happens in two passes. Parallel agents write the body of every skill first, leaving the Related Skills section empty. A second, sequential pass fills in cross-references once all skill names exist, which keeps links from pointing at files that were never created. Templates live in templates/, validation in scripts/validate-skills.py.

The skill only writes inside plugins/testing-handbook-skills/skills/, its own directory and the root README.md. Other plugins stay untouched. Sections marked draft: true, empty directories and GUI-only tools are skipped, since Claude cannot drive a graphical program. The handbook repo is looked up in ./testing-handbook, ../testing-handbook and ~/testing-handbook; if none exists, the skill asks for a path and clones https://github.com/trailofbits/testing-handbook as a last resort.

What it helps with

generate a skill set from Testing Handbook sections
refresh existing skills after handbook edits
classify sections into tool, fuzzer, technique and domain skills
wire cross-references between generated skills
run the validator over finished SKILL.md files

Example prompts for the agent

Generate skills from the Testing Handbook fuzzing sections
Refresh the skills under plugins/testing-handbook-skills/skills/ from the current handbook
Validate the generated skills with scripts/validate-skills.py

How to install testing-handbook-generator

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill testing-handbook-generator -a claude-code

2Manually: put the files in place

~/.claude/skills/testing-handbook-generator/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/testing-handbook-generator/

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill testing-handbook-generator -a codex

2Manually: put the files in place

.agents/skills/testing-handbook-generator/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill testing-handbook-generator -a cursor

2Manually: put the files in place

.cursor/skills/testing-handbook-generator/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install trailofbits/skills testing-handbook-generator

2Manually: put the files in place

.github/skills/testing-handbook-generator/SKILL.md

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill testing-handbook-generator -a gemini-cli

2Platform CLI

gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/testing-handbook-generator

Manually: put the files in place

.devin/skills/testing-handbook-generator/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add trailofbits/skills --skill testing-handbook-generator -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about testing-handbook-generator

How do I install testing-handbook-generator in Claude Code?

Run npx skills add trailofbits/skills --skill testing-handbook-generator -a claude-code. The skill lands at ~/.claude/skills/testing-handbook-generator/SKILL.md.

What does testing-handbook-generator do?

It reads Trail of Bits Testing Handbook pages and writes Claude skills from them: it decides the section type, applies the matching template and assembles a SKILL.md. A second pass adds links between the finished skills.

Does it need the handbook repository locally?

Yes. It checks ./testing-handbook, ../testing-handbook and ~/testing-handbook. When nothing is found it asks you for the path, and clones https://github.com/trailofbits/testing-handbook only as a last resort.

setup-matt-pocock-skills Matt Pocock This skill configures a repository for Matt Pocock's engineering skills by setting its issue tracker, triage labels, and domain docs layout. Run it before using the other skills. 1,052,851installs ask-matt Matt Pocock Routes you to the right Matt Pocock skill or flow for the task at hand. Use it when you need a starting point for a feature, prototype, incoming issue, or hard bug. 766,587installs to-tickets Matt Pocock Turns a plan, spec, or conversation into small end-to-end tickets with explicit blockers. Use it to agree on the work breakdown before tickets go to a tracker. 711,230installs writing-plans Jesse Vincent This skill turns requirements for a multi-step task into an implementation plan before code changes begin. It helps when another engineer needs exact files, interfaces, and checks. CX Codex 282,859installs caveman-review JuliusBrussee Turns code review comments into one line per finding: location, problem, fix. Useful when a diff or PR needs a fast pass without the filler. CX Codex +1 411,800installs caveman-compress JuliusBrussee Compresses CLAUDE.md, todo lists, and other prose files into a shorter format while retaining a readable backup. CX Codex +1 411,500installs

From the same set77

constant-time-testing This skill helps test whether a cryptographic implementation’s runtime varies with secret data. Use it when auditing crypto code or investigating a possible timing leak. CX Codex +1 5,200installs algorand-vulnerability-scanner Checks Algorand contracts written in TEAL or PyTeal against 11 known vulnerability patterns, from rekeying to unprotected admin calls. CX Codex +1 5,200installs dwarf-expert Inspects DWARF debug sections in compiled binaries, verifies DIE trees, and assists with parsers. Handy when analyzing compiled code. CX Codex +1 5,200installs libfuzzer A skill that walks the agent through libFuzzer: the harness, the -fsanitize=fuzzer build, corpus handling, campaign triage. For C/C++ built with Clang. CX Codex +1 5,200installs second-opinion Runs external CLI code reviews via Codex or Antigravity. It inspects dirty working trees, branch diffs, and specific commits without editing files. CX Codex +1 5,300installs burpsuite-project-parser Explores and queries Burp Suite project files from the command line. It extracts proxy history, scanner findings, and HTTP traffic without opening the desktop app. CX Codex +1 5,100installs yara-rule-authoring Authors and reviews YARA-X detection rules for malware hunting, flagging strings that produce weak atoms and conditions that will fire on clean files. CX Codex +1 5,100installs ruzzy This skill installs and runs Ruzzy, a coverage-guided Ruby fuzzer built on libFuzzer. Reach for it when a gem needs crash hunting or a native extension needs a memory-safety check. CX Codex +1 5,100installs