wycheproof

An agent skill by trailofbits, from trailofbits/skills. Tags: crypto, security, testing, validation.

What it does

Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill wycheproof

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/wycheproof ~/.claude/skills/wycheproof

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

trailofbits/skills (all skills from this repository)

Path

plugins/testing-handbook-skills/skills/wycheproof/SKILL.md

Branch

main

Collection

testing-handbook-skills

Updated

2026-09-19

Related skills

• constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
• post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
• pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
• qa-expert — This skill should be used when establishing comprehensive QA testing processes for any software project.
• address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
• atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.