跳到正文
cccskills
免费在 GitHub 公开

hunt-regressions

Review a specific code change and trace its callers to identify behavior that may have broken. Record suspected regressions, reachable triggers, evidence needs, and coverage gaps so a separate reproduction step can investigate them.

中文简介正在准备中。当前显示英语简介。

原文查看原文说明

Use when discovering possible regressions from a pinned change and its callers before reproduction.

查看安装方法

适用场景

  • Find possible regressions introduced by a code change
  • Trace changed behavior to supported interfaces
  • Organize candidates for reproduction
  • Record coverage gaps in a partial investigation

包含的文件(1)

  • SKILL.md2.0 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

Discover candidates

When to Use

Input: sealed preparation, frozen S0/S1, change context and registry assignment. On retry, include this assignment's prior candidate-ID mapping. The caller supplies these, including for independent use. Follow project guidance before target work.

When NOT to Use

Proving a known candidate; use reproduction. Discovery cannot confirm findings.

Hunt

  1. Read the standard and file contract. Verify preparation; read frozen change messages, PR discussion and security documentation for intent and supported use.
  2. Review the entire diff; trace changed behavior through callers to real interfaces. Use frozen sources and supplied context, not later fixes, advisories or other reviews.
  3. Record each lead's changed code, previously supported behavior, reachable trigger, proposed new defect, false-positive checks and required proof. Retain supplied leads suggesting old bugs or incomplete fixes for adjudication. Leave PoC construction to reproduction.
  4. Reserve each lead's ID through registry.py candidate using its stable hypothesis key and assigned agent handle. Reuse the key on retry. Write candidate files and hunt.json with IDs, file mappings, coverage and limitations. An empty list is valid. If blocked, record partial coverage and uninspected areas. Seal the package.

Report Back

Keep detailed evidence in the sealed package. Return only:

  • Status: complete or blocked, matching the record.
  • Record: sealed hunt.json path, or why none was produced.
  • Result: candidate count and material coverage gaps.
  • Blocker: missing prerequisite or required caller action, if blocked.

Rationalizations to Reject

  • “A helper fails on invented input”: show a supported interface that reaches it.

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Build and test code with AddressSanitizer, a tool that detects invalid memory access during execution. Configure checks for C/C++ and unsafe Rust, investigate crash reports, and adjust settings for fuzzing, or testing with generated inputs.

中文简介正在准备中。当前显示英语简介。

  • Detect memory errors while fuzzing C/C++
  • Test unsafe Rust and calls to external libraries
  • Interpret an ASan crash report
trailofbits/skills77372026年10月23日 更新

Assess source code and live reproduction evidence to decide whether a change introduced a regression, a newly caused defect. Record supported conclusions, exclusions, severity, and unresolved gaps in an evidence-linked decision file.

中文简介正在准备中。当前显示英语简介。

  • Decide whether a change introduced a new defect
  • Separate existing bugs from newly introduced defects
  • Record missing evidence and unresolved questions
trailofbits/skills77372026年10月23日 更新

aflpp

免费

Sets up AFL++ to test C/C++ programs with varied generated inputs, a technique called fuzzing. Covers running tests across CPU cores, monitoring progress, reducing input collections, and reproducing crashes for investigation.

中文简介正在准备中。当前显示英语简介。

  • Running C/C++ fuzzing across multiple CPU cores
  • Exploring further after libFuzzer progress stalls
  • Monitoring fuzzing progress and stability
trailofbits/skills77372026年10月23日 更新

Audits GitHub Actions workflows that run AI coding agents. Traces how attacker-controlled content reaches prompts, checks permissions and sandbox settings, and reports evidence, severity, and fixes for prompt injection and related configuration risks.

中文简介正在准备中。当前显示英语简介。

  • Reviewing workflows that run AI coding agents
  • Tracing issue and PR content into agent prompts
  • Checking sandbox settings and user allowlists
trailofbits/skills77372026年10月23日 更新

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

中文简介正在准备中。当前显示英语简介。

  • Security checks before an Algorand contract audit
  • Reviewing TEAL or PyTeal transaction validation
  • Verifying fixes for reported vulnerabilities
trailofbits/skills77372026年10月23日 更新

atheris

免费

Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.

中文简介正在准备中。当前显示英语简介。

  • Fuzzing a Python package or parser
  • Investigating memory corruption in Python C extensions
  • Turning raw bytes into typed test arguments
trailofbits/skills77372026年10月23日 更新

查看 trailofbits 的全部技能

报告此技能的问题