Skip to content
Security
Skill

/prepare-regression

Use when pinning before/after sources and collecting PR or commit context for a regression investigation.

GuideBOOST
From plugin
trailofbits-skills
7.7k95 skills30 agents8 commands1 MCP
Install
$ npx -y skills add trailofbits/skills --skill prepare-regression --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

  • Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
  • You can call itInvoke it directly when you want it.
  • Slash command/prepare-regression

Context preview

The summary Claude sees to decide when to auto-load this skill.

Use when pinning before/after sources and collecting PR or commit context for a regression investigation.

SKILL.md

prepare-regression.SKILL.md
name: prepare-regression
description: Use when pinning before/after sources and collecting PR or commit context for a regression investigation.

Prepare a change

When to Use

Input: PR URL or repository plus commit/range, and registry assignment. Follow [project guidance](../../references/evidence.md#project-guidance) after resolving the target commit.

When NOT to Use

The same inputs have a verified preparation record; reuse it.

Prepare

1. Read the [standard](../../docs/regression-definition.md) and [file contract](../../references/evidence.md). Pin the complete change as S0/S1: commit parent or explicit range baseline; merge base to frozen head for unmerged PRs; merge first parent to merge commit, squash parent to squash, or the complete rebased series for merged PRs. Ambiguous ranges and missing root baselines block preparation. 2. Freeze commit titles/messages or PR title, body, discussion, reviews and inline comments with URLs and collection time. Paginate APIs; record limits and lifecycle. Locate security/threat-model documents in both states; record paths or search limitations. 3. Run [snapshot.py](../../scripts/snapshot.py) via `uv run --no-project` with repository, S0, S1 and a new directory, or equivalent Git commands for special source needs. Preserve dependency/submodule/LFS revisions. Exclude later history; keep exports pristine and build in separate copies. 4. Write and seal `prepare.json` with boundary explanations, frozen context and source artifacts. If blocked, preserve collected evidence and name the prerequisite.

Report Back

Keep detailed evidence in the sealed package. Return only:

  • Status: `complete` or `blocked`, matching the record.
  • Record: sealed `prepare.json` path, or why none was produced.
  • Result: selected S0/S1 and material collection limitations.
  • Blocker: missing prerequisite or required caller action, if blocked.

Rationalizations to Reject

  • “The PR is merged”: that does not identify the complete change boundary.
Read more
Ships withtrailofbits-skills

A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.

Get the whole plugin

Other skills on trailofbits-skills.