vector-forge
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, crypto, generative, testing.
What it does
Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before/after mutation kill rates to prove vector effectiveness. Use when generating cryptographic test vectors, measuring Wycheproof coverage gaps, finding escaped mutants via mutation testing, creating cross-implementation test suites, or improving test vector coverage for crypto primitives.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill vector-forgeOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/vector-forge ~/.claude/skills/vector-forgeSafety box score
Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
Vector Forge is a local crypto-test-vector workflow that runs mutation-testing tools, analyzes code graphs, and writes new test vectors and a report into the working tree. The main risks are the installation path: it can fetch and execute remote installer scripts, install packages from the network, and on Mull setups it requires root-level changes to system directories.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It explicitly runs local tooling and tests such as `uv run trailmark analyze`, `cargo mutants`, `gremlins unleash`, and `mull-runner`, so the skill can execute project code and test binaries. |
| Network access | 2 (moderate) | It downloads dependencies and installers from the network, including `uv add --dev ...`, `go install ...@latest`, `gh release download`, and `curl -1sLf ...` bootstrap scripts. |
| Filesystem reach | 2 (moderate) | It writes outputs like `VECTOR_FORGE_REPORT.md` and new vector files in the working directory, and the Mull setup copies binaries into `/usr/local/bin` and `/usr/local/lib`. |
| Secrets & credentials | 0 (none) | The skill does not request passwords, tokens, key files, browser sessions, or `.env` contents. |
| Privilege & persistence | 3 (high) | Mull installation instructions require administrator access via `sudo apt-get install`, `sudo mkdir -p /usr/local/bin /usr/local/lib`, and `sudo cp ...`, which changes system locations. |
| Instruction hijack surface | 0 (none) | There are no hidden prompts or instructions to bypass confirmations, hide actions, or follow untrusted remote agent instructions. |
| Irreversible actions | 0 (none) | The skill generates local reports and vectors but does not deploy, publish, message, pay, or otherwise act outside the machine. |
| Transparency | 2 (moderate) | Some of the setup relies on fetched shell scripts and unpinned external artifacts, such as `curl ... setup.deb.sh | sudo -E bash` and `go install ...@latest`, which are not reviewable from the repo alone. |
Before installing
- Check whether you actually need the Mull path; if so, verify the matching `clang --version` and expect `sudo` steps.
- Run it first in a scratch repo or branch, because it will write `VECTOR_FORGE_REPORT.md` and new vector files into the working tree.
- Review `references/mutation-frameworks.md` for the commands that fetch remote installers or use `@latest` installs.
- If the target is an FFI wrapper, confirm there is a pure implementation to mutate before installing the mutation tools.
Rated 2026-10-19 by an automated review of 8 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/trailmark/skills/vector-forge/SKILL.md
- Branch
- main
- Collection
- trailmark
- Updated
- 2026-09-19
Related skills
- constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
- crypto-protocol-diagram — Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv).
- genotoxic — Graph-informed mutation testing triage.
- mermaid-to-proverif — Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.