agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.
$ npx -y skills add trailofbits/skills --skill report-regressions --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/report-regressionsContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.
name: report-regressions description: Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.
Input: frozen `scope.json`, campaign index, progress ledger, sealed stage packages and registry assignment. Follow [project guidance](../../references/evidence.md#project-guidance) for every scoped change before reporting.
Adjudicating evidence or repairing records; return those needs to the caller.
1. Read the [standard](../../docs/regression-definition.md), [labels](../../docs/report-definitions.md) and [file contract](../../references/evidence.md). Reconcile the index against frozen scope, assigned changes and discovered candidates. Preserve PR/commit IDs and accepted duplicate mappings. 2. Run [report.py](../../scripts/report.py) via `uv run --no-project` with the campaign directory and `--output ASSIGNED_DIRECTORY/reports` to render HTML, Markdown and JSON. Exit 1 means changed evidence or an invalid index; return its diagnostics and record the stage as blocked. Exit 0 may include `UNRESOLVED` findings; report each `unresolved_reason` and the `verification` level of confirmed findings. Never repair decisions, invent evidence or edit hashes to pass validation. 3. Inspect counts and links. Preserve adjudicated outcomes/ratings. Separate incomplete fixes, latent/pre-existing bugs, rejected claims and unresolved work from confirmed totals. 4. Ensure reports include coverage gaps, setup/execution evidence, rating reasons and pending human review. Report missing information; do not claim completion while required content is absent. Seal `report-stage.json` with the assigned inputs and generated reports as artifacts; record validation failures as blocked.
Keep detailed findings in the reports. Return only:
A complete report may describe an incomplete campaign.
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…