dimensional-analysis
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, blockchain, code-quality, math, security.
What it does
Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol, offchain code, or other blockchain-related codebase with arithmetic. Prevents dimensional mismatches and catches formula bugs early.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill dimensional-analysisOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/dimensional-analysis/skills/dimensional-analysis ~/.claude/skills/dimensional-analysisSafety box score
Grade C, moderate risk: 30 of 100 risk points, rated 2026-10-18. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill audits arithmetic-heavy code and automatically writes dimensional annotations and scope artifacts into the repository. The main risks are that it overrides caller control with full-auto behavior and can bulk-edit many project files without per-file approval.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | The skill does not run shell commands, scripts, or eval code; it only uses agent dispatch and workspace read/write tools. |
| Network access | 0 (none) | No downloading, uploading, or remote API calls are specified; the workflow only references local repo files like `references/step*.md`. |
| Filesystem reach | 2 (moderate) | It explicitly writes `DIMENSIONAL_SCOPE.json` and `DIMENSIONAL_UNITS.md` in the project root and says to "Apply annotations directly without per-contract approval." |
| Secrets & credentials | 0 (none) | The skill does not ask for tokens, keys, passwords, `.env` files, keychains, or browser sessions. |
| Privilege & persistence | 0 (none) | There is no sudo, global install, service registration, or shell/OS settings change in the workflow. |
| Instruction hijack surface | 3 (high) | It overrides user control with "This skill runs in one mode only: `full-auto`", "Any mode argument provided by the caller is ignored", and "Do not pause for human approvals." |
| Irreversible actions | 2 (moderate) | The skill forces a full repo-wide pipeline and automatically edits files across all in-scope arithmetic files, though it does not deploy, publish, message, pay, or delete. |
| Transparency | 0 (none) | All shipped files are plain text and readable; there are no binaries, base64 blobs, or unpinned downloads. |
Before installing
- Run it on a disposable clone or scratch branch first and inspect the diff.
- Confirm you are comfortable with unattended edits to `DIMENSIONAL_SCOPE.json`, `DIMENSIONAL_UNITS.md`, and annotated source files.
- Check the repo for any sensitive files you do not want scanned or rewritten before letting the agent run.
Rated 2026-10-18 by an automated review of 11 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/dimensional-analysis/skills/dimensional-analysis/SKILL.md
- Branch
- main
- Collection
- dimensional-analysis
- Updated
- 2026-09-19
Related skills
- code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.
- algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
- cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.