@elizaos/skills 2.0.0-alpha.10

package/skills/summarize/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: summarize
+description: Summarize or extract text/transcripts from URLs, podcasts, and local files (great fallback for “transcribe this YouTube/video”).
+homepage: https://summarize.sh
+metadata:
+  {
+    "otto":
+      {
+        "emoji": "🧾",
+        "requires": { "bins": ["summarize"] },
+        "install":
+          [
+            {
+              "id": "brew",
+              "kind": "brew",
+              "formula": "steipete/tap/summarize",
+              "bins": ["summarize"],
+              "label": "Install summarize (brew)",
+            },
+          ],
+      },
+  }
+---
+
+# Summarize
+
+Fast CLI to summarize URLs, local files, and YouTube links.
+
+## When to use (trigger phrases)
+
+Use this skill immediately when the user asks any of:
+
+- “use summarize.sh”
+- “what’s this link/video about?”
+- “summarize this URL/article”
+- “transcribe this YouTube/video” (best-effort transcript extraction; no `yt-dlp` needed)
+
+## Quick start
+
+```bash
+summarize "https://example.com" --model google/gemini-3-flash-preview
+summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview
+summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto
+```
+
+## YouTube: summary vs transcript
+
+Best-effort transcript (URLs only):
+
+```bash
+summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto --extract-only
+```
+
+If the user asked for a transcript but it’s huge, return a tight summary first, then ask which section/time range to expand.
+
+## Model + keys
+
+Set the API key for your chosen provider:
+
+- OpenAI: `OPENAI_API_KEY`
+- Anthropic: `ANTHROPIC_API_KEY`
+- xAI: `XAI_API_KEY`
+- Google: `GEMINI_API_KEY` (aliases: `GOOGLE_GENERATIVE_AI_API_KEY`, `GOOGLE_API_KEY`)
+
+Default model is `google/gemini-3-flash-preview` if none is set.
+
+## Useful flags
+
+- `--length short|medium|long|xl|xxl|<chars>`
+- `--max-output-tokens <count>`
+- `--extract-only` (URLs only)
+- `--json` (machine readable)
+- `--firecrawl auto|off|always` (fallback extraction)
+- `--youtube auto` (Apify fallback if `APIFY_API_TOKEN` set)
+
+## Config
+
+Optional config file: `~/.summarize/config.json`
+
+```json
+{ "model": "openai/gpt-5.2" }
+```
+
+Optional services:
+
+- `FIRECRAWL_API_KEY` for blocked sites
+- `APIFY_API_TOKEN` for YouTube fallback

package/skills/testing-handbook-skills/.claude-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "testing-handbook-skills",
+  "version": "1.0.0",
+  "description": "Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)",
+  "author": {
+    "name": "Paweł Płatek"
+  }
+}

package/skills/testing-handbook-skills/README.md

@@ -0,0 +1,241 @@
+# Testing Handbook Skills
+
+Meta-skill that generates Claude Code skills from the [Trail of Bits Application Security Testing Handbook](https://appsec.guide).
+
+## Overview
+
+This plugin provides a skill generator that:
+
+1. Analyzes the Testing Handbook structure
+2. Identifies skill candidates (tools, techniques, domains)
+3. Generates skills using appropriate templates
+4. Validates generated skills
+
+## Installation
+
+Add to your Claude Code skills configuration:
+
+```bash
+# From the skills marketplace
+claude skills install testing-handbook-skills
+
+# Or manually add to .claude/settings.json
+{
+  "plugins": [
+    "./plugins/testing-handbook-skills"
+  ]
+}
+```
+
+## Usage
+
+### Generate All Skills
+
+```
+Generate skills from the testing handbook
+```
+
+This will:
+1. Locate the handbook (check common locations, ask user, or clone)
+2. Scan the handbook structure
+3. Present a plan of skills to generate
+4. On approval, generate skills as siblings to `testing-handbook-generator/`
+
+### Generate Specific Skill
+
+```
+Create a skill for the libFuzzer section of the testing handbook
+```
+
+## Structure
+
+```
+plugins/testing-handbook-skills/
+├── .claude-plugin/
+│   └── plugin.json
+├── scripts/
+│   └── validate-skills.py        # Skill validation tool
+├── skills/
+│   ├── testing-handbook-generator/
+│   │   ├── SKILL.md              # Main skill entry point
+│   │   ├── discovery.md          # Handbook analysis methodology
+│   │   ├── testing.md            # Validation strategy
+│   │   ├── agent-prompt.md       # Agent prompt template for generation
+│   │   └── templates/            # Skill generation templates
+│   │       ├── tool-skill.md     # Semgrep, CodeQL
+│   │       ├── fuzzer-skill.md   # libFuzzer, AFL++, cargo-fuzz
+│   │       ├── technique-skill.md # Harness writing, coverage
+│   │       └── domain-skill.md   # Crypto testing, web security
+│   ├── [generated-skill]/        # Generated skills (siblings to generator)
+│   │   └── SKILL.md
+│   └── ...
+└── README.md
+```
+
+### Scripts
+
+| Script | Purpose |
+|--------|---------|
+| `validate-skills.py` | Validates generated skills (YAML, sections, line count, shortcodes, cross-refs) |
+
+```bash
+# Validate all skills
+uv run scripts/validate-skills.py
+
+# Validate specific skill
+uv run scripts/validate-skills.py --skill libfuzzer
+
+# JSON output for CI
+uv run scripts/validate-skills.py --json
+```
+
+## Skill Types
+
+| Type | Template | Example Sources |
+|------|----------|-----------------|
+| Tool | tool-skill.md | Semgrep, CodeQL |
+| Fuzzer | fuzzer-skill.md | libFuzzer, AFL++, cargo-fuzz |
+| Technique | technique-skill.md | Harness writing, coverage analysis |
+| Domain | domain-skill.md | Wycheproof, constant-time testing |
+
+## Generated Skills
+
+Generated skills are written as siblings to the generator:
+```
+skills/[skill-name]/SKILL.md
+```
+
+Each generated skill:
+- Follows the appropriate template structure
+- Contains content extracted from the handbook
+- Includes resource links (WebFetch summaries for non-videos)
+- Is validated with `scripts/validate-skills.py` before delivery
+
+## Skills Cross-Reference
+
+This graph shows the 16 generated skills and their cross-references (from the Related Skills section of each skill). Only links between actually generated skills are shown.
+
+```mermaid
+graph TB
+    subgraph Fuzzers
+        libfuzzer[libfuzzer]
+        aflpp[aflpp]
+        libafl[libafl]
+        cargo-fuzz[cargo-fuzz]
+        atheris[atheris]
+        ruzzy[ruzzy]
+    end
+
+    subgraph Techniques
+        harness-writing[harness-writing]
+        address-sanitizer[address-sanitizer]
+        coverage-analysis[coverage-analysis]
+        fuzzing-dictionary[fuzzing-dictionary]
+        fuzzing-obstacles[fuzzing-obstacles]
+        ossfuzz[ossfuzz]
+    end
+
+    subgraph Tools
+        semgrep[semgrep]
+        codeql[codeql]
+    end
+
+    subgraph Domain
+        wycheproof[wycheproof]
+        constant-time-testing[constant-time-testing]
+    end
+
+    %% Fuzzer → Technique references
+    libfuzzer --> address-sanitizer
+    libfuzzer --> coverage-analysis
+    aflpp --> address-sanitizer
+    cargo-fuzz --> address-sanitizer
+    cargo-fuzz --> coverage-analysis
+    libafl --> address-sanitizer
+    libafl --> coverage-analysis
+    atheris --> address-sanitizer
+    atheris --> coverage-analysis
+    ruzzy --> address-sanitizer
+
+    %% Fuzzer ↔ Fuzzer alternatives
+    libfuzzer -.-> aflpp
+    libfuzzer -.-> libafl
+    aflpp -.-> libfuzzer
+    aflpp -.-> libafl
+    cargo-fuzz -.-> libfuzzer
+    cargo-fuzz -.-> aflpp
+    cargo-fuzz -.-> libafl
+    libafl -.-> libfuzzer
+    libafl -.-> aflpp
+    libafl -.-> cargo-fuzz
+    ruzzy -.-> libfuzzer
+    ruzzy -.-> aflpp
+
+    %% Tool ↔ Tool alternatives
+    semgrep -.-> codeql
+    codeql -.-> semgrep
+
+    %% Technique → Fuzzer references
+    harness-writing --> libfuzzer
+    harness-writing --> aflpp
+    harness-writing --> cargo-fuzz
+    harness-writing --> atheris
+    harness-writing --> ossfuzz
+    fuzzing-dictionary --> libfuzzer
+    fuzzing-dictionary --> aflpp
+    fuzzing-dictionary --> cargo-fuzz
+    fuzzing-obstacles --> libfuzzer
+    fuzzing-obstacles --> aflpp
+    fuzzing-obstacles --> cargo-fuzz
+    ossfuzz --> libfuzzer
+    ossfuzz --> aflpp
+    ossfuzz --> cargo-fuzz
+    ossfuzz --> atheris
+
+    %% Technique cross-references
+    harness-writing --> address-sanitizer
+    harness-writing --> coverage-analysis
+    harness-writing --> fuzzing-dictionary
+    harness-writing --> fuzzing-obstacles
+    fuzzing-dictionary --> coverage-analysis
+    fuzzing-dictionary --> harness-writing
+    address-sanitizer --> coverage-analysis
+    ossfuzz --> address-sanitizer
+    ossfuzz --> coverage-analysis
+
+    %% Domain → Technique references
+    wycheproof --> coverage-analysis
+    constant-time-testing --> coverage-analysis
+```
+
+**Legend:**
+- Solid arrows (`→`): Primary dependencies (techniques, tools used together)
+- Dashed arrows (`-.->`): Alternative suggestions (similar tools/fuzzers)
+
+**Generated Skills Summary:**
+
+| Type | Skills |
+|------|--------|
+| Fuzzers (6) | libfuzzer, aflpp, libafl, cargo-fuzz, atheris, ruzzy |
+| Techniques (6) | harness-writing, address-sanitizer, coverage-analysis, fuzzing-dictionary, fuzzing-obstacles, ossfuzz |
+| Tools (2) | semgrep, codeql |
+| Domain (2) | wycheproof, constant-time-testing |
+
+**Note:** Some skills reference planned/external skills not yet generated (e.g., `honggfuzz`, `fuzzing-corpus`, `sarif-parsing`). Run `validate-skills.py` to see the full list.
+
+## Configuration
+
+The skill will automatically:
+1. Check common locations (`./testing-handbook`, `../testing-handbook`, `~/testing-handbook`)
+2. Ask the user for the path if not found
+3. Clone from GitHub as last resort: `https://github.com/trailofbits/testing-handbook`
+
+No hardcoded paths are used - the skill adapts to your environment.
+
+## Author
+
+Paweł Płatek
+
+## License
+
+See repository license.

package/skills/testing-handbook-skills/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: testing-handbook-skills
+description: "Application security testing toolkit from the Trail of Bits Testing Handbook. Covers fuzzing (libFuzzer, AFL++, cargo-fuzz, Atheris, Ruzzy), coverage analysis, harness writing, sanitizers, static analysis (Semgrep, CodeQL), and cryptographic testing (Wycheproof, constant-time)."
+---
+
+# Testing Handbook Skills
+
+Comprehensive security testing toolkit generated from the [Trail of Bits Application Security Testing Handbook](https://appsec.guide/).
+
+## When to Use
+
+- Setting up fuzzing campaigns for C/C++, Rust, Python, or Ruby
+- Writing fuzzing harnesses for target functions
+- Analyzing code coverage to guide testing
+- Running sanitizers (AddressSanitizer, UBSan, MSan) to catch memory bugs
+- Performing constant-time testing for cryptographic code
+- Using Wycheproof test vectors for crypto validation
+
+## When NOT to Use
+
+- Smart contract auditing (use security-building-secure-contracts)
+- Writing custom Semgrep rules (use semgrep-rule-creator)
+- General code review (use security-differential-review)
+- Vulnerability hunting without a testing plan (use audit-context-building first)
+
+## Sub-Skills (17 total)
+
+### Fuzzers
+
+| Fuzzer | Language | Best For | Skill Path |
+|--------|----------|----------|------------|
+| **libFuzzer** | C/C++ | LLVM-based coverage-guided fuzzing | [skills/libfuzzer/SKILL.md](skills/libfuzzer/SKILL.md) |
+| **AFL++** | C/C++ | Advanced mutation-based fuzzing | [skills/aflpp/SKILL.md](skills/aflpp/SKILL.md) |
+| **libAFL** | C/C++ | LibAFL-based custom fuzzers | [skills/libafl/SKILL.md](skills/libafl/SKILL.md) |
+| **cargo-fuzz** | Rust | Rust native fuzzing with libFuzzer backend | [skills/cargo-fuzz/SKILL.md](skills/cargo-fuzz/SKILL.md) |
+| **Atheris** | Python | Python coverage-guided fuzzing | [skills/atheris/SKILL.md](skills/atheris/SKILL.md) |
+| **Ruzzy** | Ruby | Ruby coverage-guided fuzzing | [skills/ruzzy/SKILL.md](skills/ruzzy/SKILL.md) |
+
+### Techniques
+
+| Technique | Purpose | Skill Path |
+|-----------|---------|------------|
+| **Harness Writing** | Writing effective fuzzing harnesses | [skills/harness-writing/SKILL.md](skills/harness-writing/SKILL.md) |
+| **Coverage Analysis** | Measuring and improving code coverage | [skills/coverage-analysis/SKILL.md](skills/coverage-analysis/SKILL.md) |
+| **Fuzzing Dictionary** | Creating effective fuzzing dictionaries | [skills/fuzzing-dictionary/SKILL.md](skills/fuzzing-dictionary/SKILL.md) |
+| **Fuzzing Obstacles** | Overcoming common fuzzing barriers | [skills/fuzzing-obstacles/SKILL.md](skills/fuzzing-obstacles/SKILL.md) |
+| **AddressSanitizer** | Memory error detection with ASan | [skills/address-sanitizer/SKILL.md](skills/address-sanitizer/SKILL.md) |
+
+### Static Analysis
+
+| Tool | Purpose | Skill Path |
+|------|---------|------------|
+| **Semgrep** | Fast pattern-matching security scans | [skills/semgrep/SKILL.md](skills/semgrep/SKILL.md) |
+| **CodeQL** | Deep semantic code analysis | [skills/codeql/SKILL.md](skills/codeql/SKILL.md) |
+
+### Cryptographic Testing
+
+| Tool | Purpose | Skill Path |
+|------|---------|------------|
+| **Wycheproof** | Test vectors for crypto implementations | [skills/wycheproof/SKILL.md](skills/wycheproof/SKILL.md) |
+| **Constant-Time Testing** | Verify constant-time crypto properties | [skills/constant-time-testing/SKILL.md](skills/constant-time-testing/SKILL.md) |
+
+### Infrastructure
+
+| Tool | Purpose | Skill Path |
+|------|---------|------------|
+| **OSS-Fuzz** | Google's continuous fuzzing service | [skills/ossfuzz/SKILL.md](skills/ossfuzz/SKILL.md) |
+
+### Meta
+
+| Tool | Purpose | Skill Path |
+|------|---------|------------|
+| **Generator** | Generate new skills from the Testing Handbook | [skills/testing-handbook-generator/SKILL.md](skills/testing-handbook-generator/SKILL.md) |
+
+## Workflow
+
+### Starting a fuzzing campaign
+
+1. **Choose a fuzzer** based on your target language (see Fuzzers table)
+2. **Write a harness** using the harness-writing skill
+3. **Build with sanitizers** (AddressSanitizer recommended as baseline)
+4. **Create a seed corpus** with representative inputs
+5. **Run the campaign** and monitor coverage
+6. **Analyze coverage** to find uncovered code and improve the harness
+7. **Triage crashes** and deduplicate findings
+
+### Setting up CI/CD testing
+
+1. **OSS-Fuzz** for open-source projects (continuous fuzzing)
+2. **Semgrep + CodeQL** for static analysis in PRs
+3. **Wycheproof** test vectors for crypto validation
+
+## Quick Start by Language
+
+| Language | Fuzzer | Harness | Sanitizer |
+|----------|--------|---------|-----------|
+| C/C++ | libFuzzer or AFL++ | `LLVMFuzzerTestOneInput` | ASan + UBSan |
+| Rust | cargo-fuzz | `fuzz_target!` macro | Built-in sanitizers |
+| Python | Atheris | `atheris.FuzzedDataProvider` | N/A |
+| Ruby | Ruzzy | `ruzzy` harness pattern | N/A |
+
+## Source Material
+
+Generated from the [Trail of Bits Application Security Testing Handbook](https://appsec.guide/) using the testing-handbook-generator meta-skill.

package/skills/testing-handbook-skills/scripts/pyproject.toml

@@ -0,0 +1,8 @@
+[project]
+name = "testing-handbook-validator"
+version = "0.1.0"
+description = "Validator for testing-handbook-generator skills"
+requires-python = ">=3.11"
+dependencies = [
+    "pyyaml>=6.0",
+]