agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
$ npx -y skills add trailofbits/skills --skill adjudicate-regression --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/adjudicate-regressionContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
name: adjudicate-regression description: Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
Input: candidate, frozen sources, available reproduction/replay packages and registry assignment. Use a fresh context distinct from the reproducer and replayer. Early exclusions may lack experiments. Follow [project guidance](../../references/evidence.md#project-guidance) before target work.
Producing missing evidence; return the gap to the caller.
1. Read the [standard](../../docs/regression-definition.md), [labels](../../docs/report-definitions.md) and [file contract](../../references/evidence.md). Verify seals. Inspect source, setup, PoC, actual logs and security assumptions, not only summaries. 2. Identify the claimed defect and assess whether the change introduced it. Rule out incomplete fixes, latent/pre-existing bugs, intentional changes, unsupported expectations and unreachable scenarios with cited evidence. Establish attacker access and applicable protections for security findings. 3. Confirm only when reproduction and independent replay ran the same PoC/input against live S0/S1 through real interfaces, showing correct behavior before and failure afterward. Explain supported behavior, reachability and patch causality. Assign severity/likelihood with reasons. 4. Otherwise select an evidenced exclusion or `UNRESOLVED`; state what remains unproved. For `UNRESOLVED`, put the standard's concise paragraph separating observed gaps, plausible explanations and resolving checks in `reason` so reports retain it. Incomplete fixes and existing bugs stay outside regression totals. Check known findings/issues/PRs before claiming novelty; report unknown if unavailable. 5. For requested deduplication, establish whether supplied candidates share a root cause. Preserve change mappings; never deduplicate unresolved claims into confirmation. 6. Write and seal `decision.json`; cite evidence for every conclusion. Record any blocker preventing adjudication.
Keep detailed reasoning in the sealed package. Return only:
A completed decision may be `UNRESOLVED`; task status and finding outcome differ.
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…