agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Use when deploying before/after systems and building a live-system PoC for a regression candidate.
$ npx -y skills add trailofbits/skills --skill reproduce-regression --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/reproduce-regressionContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when deploying before/after systems and building a live-system PoC for a regression candidate.
name: reproduce-regression description: Use when deploying before/after systems and building a live-system PoC for a regression candidate.
Input: sealed preparation/discovery packages, candidate and registry assignment. Follow [project guidance](../../references/evidence.md#project-guidance) before target work.
Independent verification of an existing PoC; use replay.
1. Read the [standard](../../docs/regression-definition.md) and [file contract](../../references/evidence.md). Verify inputs; read security guidance. Stop execution if prerequisites fail. 2. Build and run actual S0/S1 with required services. Trace the candidate to a real user/attacker entry point. Build/install CLIs and libraries; exercise supported interfaces. For build findings, execute the supported build workflow. 3. Create and execute a portable PoC against both live deployments with identical input and comparable configuration. Record whether S0 behaves correctly and S1 exhibits the claimed failure. No mocks, extracted functions or simulated systems. 4. Save setup, tool/dependency versions, sanitized configuration, input, PoC, revisions, commands and separate logs. Record observations and false-positive checks in `reproduce.json`. If blocked, retain attempted setup and exact prerequisites. Build and deploy only inside your attempt directory, and list every build directory in `build_dirs`. 5. Release temporary resources without deleting evidence. Record their disposition, then seal the package.
Keep detailed evidence in the sealed package. Return only:
Completion means the experiment finished, not that the regression is confirmed.
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…