* Commit plugin lockfiles so Dependabot can do something useful
The uv ecosystem config added in #206 pointed at four directories that declare
PEP 621 ranges and carry no lockfile. With nothing to pin, Dependabot's only
available action is raising the lower bound of an already-open range — which
changes nothing about what installs and only drops support for older versions.
It opened five such PRs within a minute of #206 merging (#208-#212), all no-ops:
the existing ranges already resolved to exactly the versions being proposed as
new floors. The one directory that did have a lockfile, constant-time-analysis,
produced no PR at all, because there was genuinely nothing to update. That is
the whole diagnosis.
Lockfiles committed for the other four. .gitignore ignored uv.lock globally,
which is why they were missing; constant-time-analysis's was tracked only
because it predates the rule. Now scoped to the root file (ephemeral — there is
no root pyproject.toml) with plugin lockfiles explicitly allowed, matching the
pattern already used for .mcp.json.
Also fixes two bugs #206 introduced:
- The version-increment check failed all five Dependabot PRs, and Dependabot can
neither bump a plugin version nor label its own PR, so every future dependency
PR would have been permanently red. Exempted by actor.
- The 'no-version-bump' label was documented in AGENTS.md and wired into
validate.yml but never created, so the escape hatch did not exist. Created.
* Re-run CI with the no-version-bump label applied
The version-increment check fired on this PR: adding uv.lock under plugins/<name>/
counts as touching those plugins. Correct behaviour — the lockfiles pin exactly
what the existing ranges already resolve to, so nothing changes for anyone
installing these plugins, which is what the label is for. First real use of the
escape hatch created in this same PR.
* Fix the three findings from this PR's review
A local uv setting leaked into all four new lockfiles. /etc/uv/uv.toml on ToB
machine images sets exclude-newer = "1 week", so every lock carried an
[options] block with exclude-newer-span = "P1W" and pinned versions resolved a
week stale — diverging from constant-time-analysis/uv.lock, which predates this
PR and has no such block. Regenerated with UV_NO_CONFIG=1. That cooldown is the
org's supply-chain posture and it belongs in dependabot.yml's
'cooldown: default-days: 7', where it already is; baking it into committed
lockfiles was my environment leaking, not a decision.
"EVERY directory here must carry a committed uv.lock" was enforced by a comment,
which is precisely the anti-pattern AGENTS.md tells people to avoid. Now a
validator check: it parses the uv ecosystem block out of dependabot.yml and
asserts a uv.lock beside each listed directory. Scoped to that block rather than
grepping for '- /plugins/...' so a future ecosystem's paths are not swept in,
and it errors if the block exists but no directories parse out — otherwise the
checker could inspect zero items and report clean, which is the exact failure it
exists to prevent. Three self-test fixtures, and verified by deleting a real
lockfile and confirming CI would go red.
The Dependabot exemption keyed on github.actor, which on a synchronize event is
whoever pushed. A human adding one commit to a Dependabot branch would re-arm
the version check and turn the PR red — making the follow-up bump mandatory
exactly where the comment says it is discretionary. Keyed on PR authorship now.
* feat(codex): add skill UI metadata
* Use official Trail of Bits logo
* fix: resolve code review findings for PR #175
Codex silently drops the icons as authored: its loader
(codex-rs/core-skills resolve_asset_path) requires icon paths
containing '..' to resolve under <plugin_root>/assets/, and the
repo-root .codex/assets location fails that containment check.
Verified empirically via codex app-server plugin/read: every
iconSmall/iconLarge came back null; only brand_color applied.
P1 fixed:
- Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for
all 38 plugins with skills and point every openai.yaml at
../../assets/trail-of-bits-mark.svg (the supported plugin-level
shared asset pattern). Icons now resolve for marketplace
installs too, since nothing escapes the plugin root.
- Drop the .codex/ additions: .codex/skills/gh-cli/agents/
openai.yaml resolved nowhere (.codex/skills is not a Codex
discovery root) and PR #173 removes the whole .codex/ tree
P2 fixed:
- Patch-bump all 38 touched plugins in plugin.json and
marketplace.json so installed clients pick up the metadata
Verified:
- Static check replicating Codex's resolution algorithm: all 73
yaml files resolve under their plugin assets/ and exist
- Live codex app-server probe: 71/72 loadable skills report
resolved iconSmall/iconLarge and brand_color #D83A34
(claude-in-chrome-troubleshooting fails to load on main due to
a pre-existing 64-char qualified-name limit, fixed by #173's
rename; zeroize-audit's manifest mcpServers object is likewise
a pre-existing Codex incompatibility fixed by #173)
- validate_codex_skills.py, validate_plugin_metadata.py, prek all
pass
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(codex): use skill-local icon assets
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(aflpp): add opinionated environment variables guide
Add a practical "Environment Variables That Matter" section covering:
- Always-set variables (AFL_TMPDIR, AFL_FAST_CAL) for free perf wins
- Multi-core campaign variables (AFL_FINAL_SYNC, AFL_TESTCACHE_SIZE)
- CI/automated fuzzing variables (AFL_EXIT_ON_TIME, AFL_NO_UI)
- Variables to avoid (AFL_NO_ARITH, AFL_SHUFFLE_QUEUE, AFL_DISABLE_TRIM)
Follow-up from PR #15 review feedback.
Closes#18
* docs(aflpp): address review feedback on env vars guide
- AFL_FAST_CAL: clarify it's recommended for slow targets, not universal
- AFL_FINAL_SYNC: correct scope to afl-cmin corpus minimization
- AFL_TESTCACHE_SIZE: add default (50 MB) and recommended range (50-250)
- AFL_NO_ARITH: note it may help for text-based formats
* fix: address review feedback on AFL env vars descriptions
- AFL_FAST_CAL: move to its own "Slow Targets" section to clarify it's
specifically recommended for slow targets, not always
- AFL_FINAL_SYNC: clarify it only matters for afl-cmin corpus
minimization, not for the fuzzing process itself
- AFL_TESTCACHE_SIZE: mention default is 50 MB and good range is 50-250 MB
- AFL_NO_ARITH: soften wording to note it may be useful for text-based targets
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Pre-commit hooks auto-fixed missing newlines at EOF and trailing
whitespace to satisfy end-of-file-fixer and trailing-whitespace checks.
Co-authored-by: Dallas McIntyre <dkmcintyre@safaricircuits.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
* init codeql merge
* test and improve
* test and improve 2
* test and improve 3
* test and improve 4, bump version, fix authors
* Bump testing-handbook-skills version for codeql skill removal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* init merge and rewrite
* semgrep done
* fix semgrep version
* Fix review issues in semgrep skill
- Replace destructive `semgrep logout` with non-destructive Pro detection
- Align marketplace.json description with plugin.json
- Add subagent_type guidance (Bash for scanners, general-purpose for triage)
- Use npx --no-install instead of --yes to prevent auto-installing packages
- Fix ruff formatting on merge_triaged_sarif.py
- Simplify brittle run number generation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix authors
* mend
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix and improve aflpp skill
* Fix typo and wrapper inconsistency in AFL++ skill
- Fix "envinroment" → "environment" typo
- Use ./afl++ wrapper consistently in libpng example
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* ci: add lint enforcement with ruff, shellcheck, and shfmt
Add pre-commit hooks (prek) and GitHub Actions CI to enforce Python and
shell linting across the repository.
- Add root pyproject.toml with ruff configuration (line-length=100, py311)
- Add .pre-commit-config.yaml with ruff, shellcheck, shfmt, and standard hooks
- Add .github/workflows/lint.yml with SHA-pinned actions
- Update .github/dependabot.yml with root pip ecosystem entry
- Fix existing lint violations:
- Auto-fix imports and formatting with ruff
- Fix duplicate dict key in ct_analyzer (contentequals -> arrays.contentequals)
- Add noqa comment for required sys.path manipulation in extract_pdf.py
- Format shell scripts with shfmt (case statement indentation)
- Add per-file-ignores for ct_analyzer's long opcode tables and style patterns
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: use 2-space indentation for shell scripts
Change shfmt configuration from 4-space to 2-space indentation
to match CLAUDE.md standards.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Dan Guido