testing-handbook-generator

An agent skill by trailofbits, from trailofbits/skills. Tags: documentation, generative, training.

What it does

Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill testing-handbook-generator

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.claude/skills/testing-handbook-generator

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This meta-skill generates and refreshes Claude Code skills from the Testing Handbook, then validates and cross-links them. Its main risks are outbound network access to clone/fetch source material and repo-wide writes to generated skills plus the root README, along with local command execution for validation.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs local commands such as `git clone --depth=1 https://github.com/trailofbits/testing-handbook.git` and `uv run scripts/validate-skills.py`, so the skill can execute shell processes as part of its workflow.
Network access	2 (moderate)	The workflow explicitly clones the handbook from GitHub and uses WebFetch on external resources, so it can make outbound requests and ingest remote content.
Filesystem reach	2 (moderate)	It writes generated files under `plugins/testing-handbook-skills/skills/[skill-name]/SKILL.md` and updates the repository root `README.md`, with regeneration explicitly allowed to overwrite existing skills.
Secrets & credentials	0 (none)	The files do not request access to tokens, passwords, keychains, browser sessions, or `.env` files.
Privilege & persistence	1 (low)	The only system-wide action mentioned is optional `brew install yq` in `testing.md`; there is no sudo, service registration, or shell/OS configuration change required.
Instruction hijack surface	0 (none)	The skill mostly constrains scope and asks for user approval before generation; it does not tell the agent to ignore safeguards, hide actions, or follow remote instructions.
Irreversible actions	2 (moderate)	After approval it can bulk-generate skills, populate cross-references, and update README in a multi-pass workflow, so it can carry out broad repository changes with limited human intervention.
Transparency	1 (low)	The files are plain markdown/yaml/shell, but the workflow pulls in remote handbook pages and web resources at runtime, so some inputs are not visible in the skill bundle itself.

Before installing

Read `SKILL.md`, `agent-prompt.md`, and `testing.md` to confirm you are comfortable with repo-wide writes and outbound fetches.
If you do not want network access, do not let it clone `https://github.com/trailofbits/testing-handbook` or fetch linked resources.
Run `uv run scripts/validate-skills.py --skill <name>` in a scratch clone first to see exactly what it changes.
Decide whether optional helper installs like `brew install yq` are acceptable on your machine.

Rated 2026-10-19 by an automated review of 10 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/testing-handbook-generator/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

mermaid-to-proverif — Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif.
continual-learning — Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to `agents-memory-updater`.
cli-demo-generator — Generates professional animated CLI demos as GIFs using VHS terminal recordings.
fine-tuning-expert — Use when fine-tuning LLMs, training custom models, or adapting foundation models for specific tasks.
prompt-engineer — Writes, refactors, and evaluates prompts for LLMs — generating optimized prompt templates, structured output schemas, evaluation rubrics, and test suites.
prompt-optimizer — Transform vague prompts into precise, well-structured specifications using EARS (Easy Approach to Requirements Syntax) methodology.