Skip to content
cccskills
FreePublished on GitHub

reproduce-regression

Build and run systems before and after a change, then execute the same reproduction procedure against both. Save environment details, inputs, commands, and separate logs to document observed behavior and any setup blockers.

OriginalShow the original description

Use when deploying before/after systems and building a live-system PoC for a regression candidate.

See how to install

Good for

  • Compare behavior before and after a change
  • Create a portable procedure to reproduce a suspected defect
  • Record environments, commands, and execution logs
  • Document prerequisites that prevent reproduction

Files included (1)

  • SKILL.md2.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Reproduce a candidate

When to Use

Input: sealed preparation/discovery packages, candidate and registry assignment. Follow project guidance before target work.

When NOT to Use

Independent verification of an existing PoC; use replay.

Reproduce

  1. Read the standard and file contract. Verify inputs; read security guidance. Stop execution if prerequisites fail.
  2. Build and run actual S0/S1 with required services. Trace the candidate to a real user/attacker entry point. Build/install CLIs and libraries; exercise supported interfaces. For build findings, execute the supported build workflow.
  3. Create and execute a portable PoC against both live deployments with identical input and comparable configuration. Record whether S0 behaves correctly and S1 exhibits the claimed failure. No mocks, extracted functions or simulated systems.
  4. Save setup, tool/dependency versions, sanitized configuration, input, PoC, revisions, commands and separate logs. Record observations and false-positive checks in reproduce.json. If blocked, retain attempted setup and exact prerequisites. Build and deploy only inside your attempt directory, and list every build directory in build_dirs.
  5. Release temporary resources without deleting evidence. Record their disposition, then seal the package.

Report Back

Keep detailed evidence in the sealed package. Return only:

  • Status: complete or blocked, matching the record.
  • Record: sealed reproduce.json path, or why none was produced.
  • Result: one sentence describing observed S0/S1 behavior.
  • Blocker: missing prerequisite or required caller action, if blocked.

Completion means the experiment finished, not that the regression is confirmed.

Rationalizations to Reject

  • “The unit test proves it”: synthetic tests cannot establish a regression.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Build and test code with AddressSanitizer, a tool that detects invalid memory access during execution. Configure checks for C/C++ and unsafe Rust, investigate crash reports, and adjust settings for fuzzing, or testing with generated inputs.

  • Detect memory errors while fuzzing C/C++
  • Test unsafe Rust and calls to external libraries
  • Interpret an ASan crash report
trailofbits/skills7.7KUpdated Oct 22, 2026

Assess source code and live reproduction evidence to decide whether a change introduced a regression, a newly caused defect. Record supported conclusions, exclusions, severity, and unresolved gaps in an evidence-linked decision file.

  • Decide whether a change introduced a new defect
  • Separate existing bugs from newly introduced defects
  • Record missing evidence and unresolved questions
trailofbits/skills7.7KUpdated Oct 22, 2026

aflpp

FreeSummary

Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.

  • Running C/C++ fuzzing across multiple CPU cores
  • Exploring further after libFuzzer progress stalls
  • Monitoring fuzzing progress and stability
trailofbits/skills7.7KUpdated Oct 22, 2026

Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.

  • Reviewing workflows that run AI coding agents
  • Tracing issue and PR content into agent prompts
  • Checking sandbox settings and user allowlists
trailofbits/skills7.7KUpdated Oct 22, 2026

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

  • Security checks before an Algorand contract audit
  • Reviewing TEAL or PyTeal transaction validation
  • Verifying fixes for reported vulnerabilities
trailofbits/skills7.7KUpdated Oct 22, 2026

atheris

FreeSummary

Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.

  • Fuzzing a Python package or parser
  • Investigating memory corruption in Python C extensions
  • Turning raw bytes into typed test arguments
trailofbits/skills7.7KUpdated Oct 22, 2026

See all skills by trailofbits

Report a problem with this skill