[agents](https://carteblanche.com/index.md?kind=agent) / [code](https://carteblanche.com/index.md?category=code) # sharp-edges-analyzer what it does Evaluates APIs, configurations, and library interfaces for misuse resistance and footgun potential. Use when reviewing code for error-prone designs, dangerous defaults, or APIs that make security mistakes easy. tools it asks for Reads files by trailofbits · version 1 · license CC-BY-SA-4.0 We imported this agent from its author’s repository. Is this yours? [Claim this listing](https://carteblanche.com/claim/sharp-edges-analyzer) Verified · Before and after: 2 models · 1 try per case · [View source](https://github.com/trailofbits/skills/blob/e4dd0bb5b15535f7c5a0834187dffba6ac37e4ff/plugins/sharp-edges/agents/sharp-edges-analyzer.md) · [Install from your agent](https://carteblanche.com/connect.md) · [Download .zip](https://carteblanche.com/skills/sharp-edges-analyzer/download) ## Compare the answers Answers from Claude Sonnet 5.5 and GPT-6.1 Sol · try 1 of 1 Same request, same model, once with the agent’s instructions as its system prompt and once without. Neither could use a tool. Read both and judge for yourself. [Compare the answers](https://carteblanche.com/skills/sharp-edges-analyzer/compare) ## The models 2 models Claude Sonnet 5.5 made by Anthropic claude-sonnet-5-5 · revision not reported by the provider 1 try per case · tested 7 Nov 2026 GPT-6.1 Sol made by OpenAI gpt-6.1-sol · revision not reported by the provider 1 try per case · tested 7 Nov 2026 ## The tasks written by Carte Blanche **example-1** “I'm designing a small Python crypto helper library. Here's the main interface: \`encrypt(data, key, mode='ECB', iv=None)\` and \`verify\_token(token, secret, check\_signature=True)\`. If iv is None, it silently uses a zero IV. Can you review this for footguns and dangerous defaults, and suggest how to redesign it so the safe path is the easy one?” **example-2** “Our team is about to ship a YAML-based config for our deployment tool. Sample: \`auth: {enabled: false, tls\_verify: false, allow\_origins: '\*'}\` is the default template, and any unknown keys are silently ignored. Debug mode is on unless \`debug: false\` is set. Please analyze this config design for misuse potential and tell me which defaults and behaviors people are likely to get wrong.” ## Install Download the .zip and unzip it. Put `sharp-edges-analyzer.md` here: Claude Code · `~/.claude/agents/` · Every project. For one project only, use .claude/agents/ inside it. It gives the agent the tools it asks for, and no others. Cursor · `~/.cursor/agents/` · Cursor also reads the Claude Code folder above. It has no tools field, so it gives every agent every tool, whatever this one asks for. Codex · Codex’s custom agents are TOML files, not Markdown, so this agent doesn’t install there. Keep its license file beside it, as `sharp-edges-analyzer.LICENSE`: a name that doesn’t end in .md, since every .md file there is read as an agent. Then start a new session and ask for it by name. Folders checked 6 November 2026. Or [install from your agent](https://carteblanche.com/connect.md): ask it to install `sharp-edges-analyzer` from Carte Blanche. ## Badge for your README Carte Blanche: Verified Paste this into the agent’s README. It links to this page, and shows how the listing stands whenever it’s loaded. ``` [![Carte Blanche](https://carteblanche.com/badge/sharp-edges-analyzer.svg)](https://carteblanche.com/skills/sharp-edges-analyzer) ``` ## About this test - **tested**: 7 Nov 2026 - **version tested**: v1 - **cases**: 2 - **tries per case**: 1 try per case - **run without the agent**: yes - **cases written by**: Carte Blanche - **size**: 7868 characters What this shows, and what it doesn’t How 2 models answered these 2 requests, with and without the agent. It says nothing about other models, and it doesn’t limit what your own agent can do. The answers were written without tools: the agent’s instructions were the system prompt, and it read no file and ran nothing. [How we test](https://carteblanche.com/how-it-works.md)