dwarf-expert

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, cli, code-quality, debugging, developer-tools.

What it does

Analyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill dwarf-expert

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/dwarf-expert/skills/dwarf-expert ~/.claude/skills/dwarf-expert

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only DWARF analysis helper: it inspects local binaries, object files, and debug sections with tools like `dwarfdump`, `readelf`, `grep`, and sometimes Python scripts. The main risks are modest execution of local analysis commands and optional web lookups to external documentation sites; it does not describe privilege changes, secret access, or destructive actions.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It explicitly uses local commands and pipelines such as `dwarfdump`, `readelf`, `grep -B`, and sometimes a Python script with `pyelftools`, but nothing suggests running downloaded code or arbitrary shell snippets.
Network access	1 (low)	The "Authoritative Sources" section recommends `WebSearch`/`WebFetch` against dwarfstd.org, LLVM, and GitHub/libdwarf, so queries may leave the machine even though the purpose is documentation lookup.
Filesystem reach	1 (low)	It reads binaries, object files, and on macOS `.dSYM` bundles or `.o` files, but the skill text describes inspection only and no writes or deletes outside the project.
Secrets & credentials	0 (none)	There is no instruction to access tokens, keychains, `.env` files, browser sessions, or other credential stores.
Privilege & persistence	0 (none)	No sudo, global installs, service registration, shell startup edits, or other privilege-changing steps are described.
Instruction hijack surface	0 (none)	The text gives analysis guidance and source recommendations only; it does not ask the agent to ignore instructions, hide behavior, or follow remote prompts.
Irreversible actions	0 (none)	The skill is limited to inspection and verification of DWARF data; it does not publish, deploy, send messages, pay, or otherwise act on the user's behalf.
Transparency	0 (none)	All files shown are plain text/SVG, and the documented commands are visible; there are no binaries, packed installers, or decoded-at-runtime payloads.

Before installing

Confirm you are okay with the skill reading local binaries, object files, and `.dSYM` bundles for debug info.
If external lookups are a concern, avoid or disable `WebSearch`/`WebFetch` before using the skill.
Check that the binaries you will inspect do not contain sensitive source paths or debug-only data you would not want exposed.

Rated 2026-10-15 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/dwarf-expert/skills/dwarf-expert/SKILL.md
Branch: main
Collection: dwarf-expert
Updated: 2026-09-19

c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
rust-engineer — Writes, reviews, and debugs idiomatic Rust code with memory safety and zero-cost abstractions.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.