property-based-testing

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, automation, code-quality, testing, validation.

What it does

Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order, data structures, and smart-contract state invariants. Also use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill property-based-testing

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/property-based-testing/skills/property-based-testing ~/.claude/skills/property-based-testing

Safety box score

Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only skill for writing and reviewing property-based tests; it ships no runnable scripts, installers, or networked tooling. The main effect is normal repo churn in the working tree: adding tests, and sometimes refactoring code to expose properties. There is no obvious secrets, privilege, or external-action blast radius.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill documents shell inspection commands like `rg "@given\(\|from hypothesis import" --type py`, so an agent may run read-only commands while using it, but it ships no executable scripts or code evaluators.
Network access	0 (none)	It only mentions a tutorial link (`secure-contracts.com`) and no command that downloads from or sends data to a remote host.
Filesystem reach	1 (low)	Its purpose is to write tests and sometimes refactor production code; e.g. `Suggest the refactor` and `change to production code to make a test possible is their call`, which means edits inside the checkout but not outside it.
Secrets & credentials	0 (none)	There is no guidance to read tokens, passwords, keychains, `.env` files, or browser sessions.
Privilege & persistence	0 (none)	No `sudo`, global install, service registration, shell-startup edits, or OS-level configuration changes are mentioned.
Instruction hijack surface	0 (none)	The files do not tell the agent to ignore its rules, hide information, follow remote instructions, or adopt a deceptive persona.
Irreversible actions	0 (none)	The skill is about test authoring/reviewing and does not itself push, deploy, post, pay, book, or delete anything.
Transparency	0 (none)	All shipped files are plain text, including the SVG asset; there are no binaries, minified blobs, or decoded-at-runtime code.

Before installing

Search the target repo for an existing PBT library first; this skill assumes Hypothesis/fast-check/proptest-style tests may already exist.
Check whether you are okay with the skill suggesting production-code refactors, not just new tests.
If you use Solidity invariants, confirm Echidna or Medusa is already part of your toolchain before relying on those paths.

Rated 2026-10-21 by an automated review of 9 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/property-based-testing/skills/property-based-testing/SKILL.md
Branch: main
Collection: property-based-testing
Updated: 2026-09-19

mutation-testing — Configures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
genotoxic — Graph-informed mutation testing triage.
post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
slicing-code-context — Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent.
blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.