constant-time-analysis

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, code-quality, crypto, debugging, security.

What it does

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill constant-time-analysis

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/constant-time-analysis/skills/constant-time-analysis ~/.claude/skills/constant-time-analysis

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill statically analyzes cryptographic source by compiling it and inspecting emitted assembly or bytecode. The main risks are the toolchain execution itself, plus setup instructions that fetch packages, modify PATH/dotfiles, and use sudo for system-wide installs.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It repeatedly runs compilers and runtime tooling via commands like `uv run {baseDir}/ct_analyzer/analyzer.py`, `go tool objdump`, and `node --print-bytecode`, so it executes a real toolchain on user-supplied source.
Network access	2 (moderate)	Setup guidance fetches external content with `curl -fsS https://pecl.php.net/package/vld` and may fall back to `npx tsc`, which can download packages from a registry.
Filesystem reach	2 (moderate)	The docs instruct edits outside the project, including `~/.zshrc` / `~/.bashrc`, `$HOME/.dotnet/tools`, and system extension directories like `PHP_EXT_DIR`.
Secrets & credentials	1 (low)	The skill is about code that handles keys/tokens and includes Keychain examples, but it does not ask to read, export, or request credentials from the machine.
Privilege & persistence	3 (high)	Several setup steps require elevated or system-wide changes, including `sudo apt install openjdk-21-jdk`, `sudo make install`, `sudo tee -a ...`, and `sudo cp modules/vld.so ...`.
Instruction hijack surface	0 (none)	There is no instruction to ignore higher-priority rules, follow remote prompts, or hide actions; the files are plain analysis guidance.
Irreversible actions	0 (none)	The skill analyzes code only and does not post, deploy, delete, pay, or otherwise act autonomously on external systems.
Transparency	2 (moderate)	The operational core `ct_analyzer/analyzer.py` is invoked throughout but is not included in the supplied files, so its behavior cannot be directly inspected here.

Before installing

Read `references/php.md` and `references/vm-compiled.md` first; they contain `sudo` installs and dotfile edits.
Inspect the missing `ct_analyzer/analyzer.py` before trusting the skill, since it is the operational core and is not included here.
If you install prerequisites, do it in a throwaway user or VM first, because the docs may change PATH and system-wide runtimes.
Be cautious with the `curl` and `npx`-based setup paths; verify you are comfortable fetching code from the network.

Rated 2026-10-19 by an automated review of 12 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md
Branch: main
Collection: constant-time-analysis
Updated: 2026-09-19

audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
differential-review — Performs security-focused differential review of code changes.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.