agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.
$ npx -y skills add trailofbits/skills --skill implement-patch --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/implement-patchContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.
name: implement-patch description: Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.
Use after independent validation confirms one claim. Read the [record contract](../../references/records.md). Before target commands, follow its [project guidance](../../references/records.md#project-guidance).
Do not use for speculative bug hunting, proof of a completed patch, or a change that cannot be exercised by the local compiler or runtime.
1. Before editing, run `uv run --no-project <script> check --before-repair <run-dir>` with the [record validator](../../scripts/records.py). If this check fails, stop and return its errors for an INCONCLUSIVE report. The gate requires `finding.repair_scope` with a usable case plan and a consistent attempt count. Use the declared scope as the repair brief. Identify the broken invariant and search within its boundary for every instance of the same violation. Read the threat model only to preserve intended behavior; it is not a gate. 2. Run the project's existing suite and record its results. Write a regression test that fails on the baseline for the named bug and any fixed variant. Observe the failure. Fix the invariant within the repair brief with the smallest reviewable change. 3. Run the regression test and full existing suite again. Compare before and after failures. Fix new failures or explain a pre-existing one from receipts. 4. Record every variant as `fixed` or `not_fixed` with a reason. Produce exactly one local commit. Never push or open a PR. From the baseline, write `fix.patch` for production changes and `tests.patch` for test changes in `patch/attempt-N/`. 5. Write `patch.json` with the two commit SHAs, changed-file and line counts, variants, suite results, and your agent identity. If the attempt produced no commit, record `patch_commit: null` and return it as failed. Manifest the entire attempt directory, including both patch files and the record, using `uv run --no-project <script> manifest <patch-attempt-dir>`. Check it with the [record validator](../../scripts/records.py).
[Patch record schema](../../schemas/patch.schema.json):
{
"schema_version": 1,
"attempt": 1,
"baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"patch_commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"files_changed": 2,
"lines_added": 3,
"lines_removed": 1,
"variants": [],
"suite_before": {"command": "pytest", "passed": 9, "failed": 1, "skipped": 0},
"suite_after": {"command": "pytest", "passed": 10, "failed": 0, "skipped": 0},
"agent": "patcher-1"
}| Shortcut | Required action | | --- | --- | | Only the reported line matters. | Search for the same invariant violation. | | Minimal means the fewest lines. | Make the smallest reviewable invariant-level fix. | | Tests pass after the patch. | Show the regression test failed before it. |
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…