wycheproof — Claude Code skill: what it does, how to install
Validates cryptographic implementations using Project Wycheproof test vectors. It helps your agent spot known vulnerabilities and edge cases across AES, RSA, and ECDSA.
npx skills add trailofbits/skills --skill wycheproof -a claude-codeWhat wycheproof does
This skill guides coding agents through Project Wycheproof, a suite of test vectors designed to uncover flaws in cryptographic software. It explains how to load JSON test cases from testvectors_v1, filter groups by key sizes or curves, and interpret attributes like tcId, comment, and flags. The agent learns to map expected results—valid, acceptable, or invalid—against library behavior.
Supported algorithms span symmetric encryption like AES-GCM and ChaCha20-Poly1305, signature algorithms such as ECDSA and RSA, and ECDH key exchanges. It works well for building test harnesses, auditing code, or investigating why two implementations produce different outputs on identical inputs.
Do not expect it to detect timing side-channels. Wycheproof works strictly with fixed test vectors and cannot substitute for fuzzing or constant-time verification tools.
What it helps with
- validate an AES-GCM implementation against known test vectors
- detect ECDSA signature malleability and DER encoding flaws
- test ECDH key exchanges against invalid curve attacks
- diagnose why two crypto libraries produce conflicting results
Example prompts for the agent
- Test our AES-GCM implementation against Wycheproof vectors in aes_gcm_test.json
- Write a test runner for ECDSA verification on secp256k1 using testvectors_v1
- Add Wycheproof as a git submodule and wire the invalid test cases into our test harness
How to install wycheproof
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill wycheproof -a claude-code2Manually: put the files in place
~/.claude/skills/wycheproof/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/wycheproof/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill wycheproof -a codex2Manually: put the files in place
.agents/skills/wycheproof/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill wycheproof -a cursor2Manually: put the files in place
.cursor/skills/wycheproof/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills wycheproof2Manually: put the files in place
.github/skills/wycheproof/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill wycheproof -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/wycheproofManually: put the files in place
.devin/skills/wycheproof/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill wycheproof -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set35
The whole set →Similar
Questions about wycheproof
How do I install wycheproof in Claude Code?
Run npx skills add trailofbits/skills --skill wycheproof -a claude-code in your terminal.
What does the wycheproof skill do?
It teaches the agent how to parse Project Wycheproof test vectors, organize test groups, and verify crypto implementations against expected valid, invalid, and acceptable outcomes.
Can Wycheproof find timing side-channel vulnerabilities?
No, it only checks implementations against mathematical edge cases and known attack patterns. Timing attacks require constant-time analysis tools instead.
