Takes your mutation testing results and stops you from writing tests for the wrong reasons. It runs Trailmark to build a call graph, then cross-references survived mutants with code structure to sort them into false positives (dead code, logging strings), missing unit tests, or functions complex enough to need fuzzing instead. The necessist integration finds weak assertions by removing test statements to see what still passes. Honest take: mutation testing generates noise, and most teams either ignore it or waste time on harmless mutants. This actually triages the output using reachability and data flow, which is the only way to make mutation testing actionable at scale. Requires trailmark and a language-specific mutation framework installed upfront.

skills.sh installs
4.2K
GitHub stars
8.1K
last updated
Aug 21, 2026

Install

$ npx -y skills add trailofbits/skills --skill genotoxic --agent claude-code

Installs into .claude/skills of the current project.

Files

Genotoxic

Combines mutation testing and necessist (test statement removal) with code graph analysis to triage findings into actionable categories: false positives, missing unit tests, and fuzzing targets.

When to Use

  • After mutation testing reveals survived mutants that need triage
  • Identifying where unit tests would have the highest impact
  • Finding functions that need fuzz harnesses instead of unit tests
  • Prioritizing test improvements using data flow context
  • Filtering out harmless mutants from actionable ones
  • Finding unnecessary test statements that indicate weak assertions (necessist)

When NOT to Use

  • Codebase has no existing test suite (write tests first)
  • Pure documentation or configuration changes
  • Single-file scripts with trivial logic

Prerequisites

Sponsors

Details

Repository
github.com/trailofbits/skills
Category
Testing & QA
First seen
May 16, 2026

More from trailofbits/skills

All 82
1giuseppe-trisciuoglio avatarturborepo-monorepogiuseppe-trisciuoglio/developer-kitProvides comprehensive Turborepo monorepo management guidance for TypeScript/JavaScript projects. Use when creating Turborepo workspaces, configuring turbo.json4.2Kskills.sh installs
2trailofbits avatarvector-forgetrailofbits/skillsMutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then 4.2Kskills.sh installs
3dotnet avatarplatform-detectiondotnet/skillsReference data for detecting the test platform (VSTest vs Microsoft.Testing.Platform) and test framework (MSTest, xUnit, NUnit, TUnit) from project files. DO NO4.2Kskills.sh installs
4dotnet avatarwriting-mstest-testsdotnet/skillsWrite, create, modernize, or fix comprehensive MSTest unit tests with MSTest 3.x/4.x APIs. USE FOR: write, create, review, or modernize MSTest tests and asserti4.2Kskills.sh installs
5dotnet avatardetect-static-dependenciesdotnet/skillsScan C# source files for hard-to-test static dependencies — DateTime.Now/UtcNow, File.*, Directory.*, Environment.*, HttpClient, Console.*, Process.*, and other4.1Kskills.sh installs
6dotnet avatarmtp-hot-reloaddotnet/skillsSuggests using Microsoft Testing Platform (MTP) hot reload to iterate fixes on failing tests without rebuilding. Use when user says "hot reload tests", "iterate4.1Kskills.sh installs