Mutation Testing

Configures mewt or muton mutation testing campaigns — scopes targets, tunes timeouts, and optimizes long-running runs. Use when the user mentions mewt, muton, mutation testing, or wants to configure or optimize a mutation testing campaign.

Published by @Trail of Bits·from trailofbits/skills·0 agent reads / 30d·0 saves·

Mutation Testing — Campaign Configuration (mewt/muton)

Note: muton and mewt share identical interfaces but target different languages — mewt for general-purpose languages (Rust, Solidity, Go, TypeScript, JavaScript), muton for TON smart contracts (Tact, Tolk, FunC). All examples use mewt commands, but they work exactly the same with muton. File names change accordingly: mewt.tomlmuton.toml, mewt.sqlitemuton.sqlite.

When to Use

Use this skill when the user:

  • Mentions "mewt", "muton", or "mutation testing"
  • Needs to configure or optimize a mutation testing campaign
  • Wants to run mewt run and needs help getting set up first

When NOT to Use

Do not use this skill when the user:

  • Wants to analyze or report on completed campaign results
  • Asks about tests or coverage without mentioning mutation testing

Quick Start

Load workflows/configuration.md — a 5-phase guide from mewt init to a validated, ready-to-run campaign.

General question or unfamiliar command? Run mewt --help or mewt <subcommand> --help, then assist.


Reference Index

FileContent
workflows/configuration.md5-phase guide: init, scope, optimize, validate, run
references/optimization-strategies.mdPer-file targeting, two-phase campaigns, mutation type filtering

Essential Commands

# Initialize and mutate
mewt init                    # Create mewt.toml and mewt.sqlite
mewt mutate [paths]          # Generate mutants without running tests
mewt run [paths]             # Run the full campaign

# Inspect configuration and scope
mewt print config            # View effective configuration
mewt print targets           # Table of all targeted files
mewt print mutations --language [lang]  # Available mutation types
mewt status                  # Mutant count and per-file breakdown

# Investigate specific mutants
mewt print mutants --target [path]   # All mutants for a file
mewt print mutants --severity high   # Filter by severity
mewt print mutant --id [id]          # View mutated code diff
mewt test --ids [ids]                # Re-test specific mutants

What Results Mean

  • Caught/TestFail: Tests detected the mutation (good)
  • Uncaught: Mutation survived — indicates untested logic
  • Timeout: Tests took too long, inconclusive
  • Skipped: A more severe mutant already failed on the same line

Bundled with this artifact

6 files

Reference files that ship alongside this artifact. Agents pull these in only when the task needs them.

More on the bench

SKILL0

Security Threat Model

Write a STRIDE-based threat model for a service or feature. Use when asked to produce a threat model, document security risks, identify attack vectors, assess a service's security posture, or prepare for a security design review. Produces a structured threat model covering assets, trust boundaries, STRIDE threat enumeration per component, risk scores, mitigation controls, and residual risk sign-off.

software-engineering+1
29
SKILL0

Skill Security Auditor

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".

cybersecurity-soc+2
1
SKILL0

Devsecops Ssdlc Appsec Cursor Rule

Cursor rules for secure coding, secret handling, dependency hygiene, authentication, authorization, security testing, and compliance documentation.

cybersecurity-soc+1
0