mutation-testing
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, automation, code-quality, debugging, testing.
What it does
Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill mutation-testingOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/mutation-testing/skills/mutation-testing ~/.claude/skills/mutation-testingSafety box score
Grade B, low risk: 18 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a local mutation-testing operator: it runs `mewt` commands, executes the project’s test command, writes config/report files, and can purge campaign data. The main risks are bounded shell execution and destructive local file changes; it does not appear to phone home, touch secrets, or require elevated privileges.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | The skill explicitly directs shell execution via commands like `mewt init`, `mewt mutate`, `mewt run`, `mewt test`, and `time <test-command-from-config>`; this is inherent to the workflow but bounded to local project tooling. |
| Network access | 0 (none) | The files contain no `curl`, remote fetches, API calls, or data exfiltration paths; the workflow stays on local `mewt` commands and project tests. |
| Filesystem reach | 2 (moderate) | It creates and edits `mewt.toml`, `mewt.sqlite`, and `mutation-testing-report.md`, and the optimization guidance includes `mewt purge`/`mewt purge --all`, which delete saved campaign data in the working area. |
| Secrets & credentials | 0 (none) | There is no instruction to read credential stores, `.env` files, browser sessions, or paste tokens/passwords. |
| Privilege & persistence | 0 (none) | No sudo, service registration, shell startup edits, or global installs are requested. |
| Instruction hijack surface | 0 (none) | The text does not ask the agent to ignore its rules, follow remote instructions, hide actions, or assume an unsafe persona. |
| Irreversible actions | 1 (low) | It can autonomously run multi-step campaigns and re-test survivors with `mewt run` and `mewt test`, but it does not publish, deploy, message, pay, or otherwise affect external systems. |
| Transparency | 0 (none) | All shipped files are readable text (Markdown, YAML, SVG); there are no binaries, minified blobs, or downloaded installers. |
Before installing
- Read `workflows/configuration.md` if you do not want the skill to create `mewt.toml`/`mewt.sqlite` in the repo root.
- Treat `mewt purge --all` as destructive to campaign history; try it only on a scratch copy first.
- Confirm the project’s test command is safe to run locally, because the skill invokes it directly during campaigns.
- If you only want analysis, avoid the optimization path that rewrites targets and purges old mutants.
Rated 2026-10-20 by an automated review of 12 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/mutation-testing/skills/mutation-testing/SKILL.md
- Branch
- main
- Collection
- mutation-testing
- Updated
- 2026-09-19
Related skills
- property-based-testing — Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants.
- python-pro — Use when building Python 3.11+ applications requiring type safety, async programming, or robust error handling. Generates type-annotated Python code.
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
- code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.