skills

You can write algorithms that leak every bit of your secrets, trivially. The npm "elliptic" package does this. Daniel Bleichenbacher has tested several packages' timing leakage in Rooterberg that are easily exploited: https://github.com/bleichenbacher-daniel/Rooterberg/blob/mai... You can use algorithm implementations that do not have secret-dependent timing differences in any language, as long as you are clear that your guarantees do not extend to the underlying runtime or to compiler optimizations. This isn't perfect, but it's better. You can go further Rust-to-WASM and use tools like https://github.com/trailofbits/skills/tree/main/plugins/cons... to check the assembly and the runtime that the assembly runs in. (Most of the linked Claude skill is a Python program. It just relies on AI to eliminate false positives.) The real question is:

Can't you just, wire your agent into a Python script and have it infinitely check its own work? That would hit the metrics, but do nothing useful. Hell, throw a Tarot reading in the middle of the loop so the agent has non-deterministic behavior too. https://github.com/trailofbits/skills/tree/main/plugins/let-... Amazon management wants to play five-dimensional chess? Play Balatro instead.

To test a Claude Skill for analyzing cryptographic implementations of cryptographic side-channels ([1] see constant-time-analysis), I had Claude vibe-code an Ed448 implementation. This includes: 1. The Ed448 signature algorithm 2. The Edwards448 elliptic curve group (which could conceivably be used for ECDH) 3. The Decaf448 prime-order group (a much better target for doing non-EdDSA things with) I've been putting off reviewing it and making the implementation public (as it was an exercise in "is this skill a sufficient guard-rail against implementation error" more than anything), but if there's any interest in this from the Go community, I'll try to prioritize it later this year. (I'm not publishing it without approval from the rest of the cryptography team, which requires an internal review.) But if you're curious about the efficacy of t