reproduce-bug
Use when a named runtime or compiler bug in a local repository needs independent reproduction.
Install / Use
npx skills add trailofbits/skills --skill reproduce-bugInstalls into whichever agent you are using.
SKILL.md
Installable skill definition
Quality Score
Category
LegalSupported Platforms
Tags
Our assessment of reproduce-bug
reproduce-bug scores 83/100 on our quality scale, 162nd of 222 Legal skills we index.
Its SKILL.md is 2.8 KB long, split into 5 sections with 1 code example: a solid amount of guidance for an agent.
With 7,225 GitHub stars, it is one of the more widely adopted skills in the catalogue.
Maintenance, license and trust
- The repository was last updated 27 days ago, so reproduce-bug is actively maintained.
- It is released under the CC-BY-SA-4.0 license; check its terms before commercial use.
- Its trust signals score 100/100, with no cautions. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.
reproduce-bug compared with similar skills
All 4 of these similar skills score higher than reproduce-bug; compare them before choosing.
| Skill | Score | Stars | Updated | Format |
|---|---|---|---|---|
| reproduce-bug (this skill)by trailofbits | 83 | 7.2k | 27d ago | SKILL.md |
| algorithmic-artby anthropics | 100 | 177.9k | 28d ago | SKILL.md |
| pptxby anthropics | 100 | 177.9k | 28d ago | SKILL.md |
| designby nextlevelbuilder | 100 | 137.2k | 6d ago | SKILL.md |
| ui-ux-pro-maxby nextlevelbuilder | 100 | 137.2k | 6d ago | SKILL.md |
Frequently asked questions
- How do I install reproduce-bug?
- Run
npx skills add trailofbits/skills --skill reproduce-bug. The install tabs above show the steps for each supported agent. - Which AI agents does reproduce-bug work with?
- It is written for Universal, as a SKILL.md file. Other agents that read the same format can often use it too.
- Is reproduce-bug safe to use?
- It is CC-BY-SA-4.0-licensed and scores 100/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
- Is reproduce-bug still maintained?
- The repository was last updated 27 days ago, so reproduce-bug is actively maintained.
Skill content
View source on GitHubname: reproduce-bug description: Use when a named runtime or compiler bug in a local repository needs independent reproduction.
Reproduce Bug
When to Use
Use for the reproduction step of patching-bugs with one finding.json and a local
baseline checkout. Read the record contract.
Before target commands, follow its project guidance.
When NOT to Use
Do not use for bug discovery, patching, or a claim that cannot be exercised locally. Report a blocker when the build or environment cannot exercise the claim.
Procedure
-
Select
failure_typefrom the record contract. Build the current baseline with the project's own command. Exercise the planned scoped inputs before any edit and retain their observations, including valid controls. Save raw stdout, stderr, exit status, and timing. If the behavior is absent with trustworthy evidence, reportnot_reproduced; if setup or observations are unreliable, reportblocked. -
Runtime: exercise the built
target_artifactwith a PoC that recordsPATCH_LOADEDas defined in the contract, then printsPATCH_REACHEDimmediately before the assertion. Exit nonzero for the bug, zero otherwise; a setup crash is inconclusive. Compile: record the targetexpected_diagnosticfrom the failed compiler invocation; use emptypoc_argvand nulltarget_artifact. -
Save any unchanged PoC source under
reproduce/poc/and raw receipts underreproduce/receipts/. Writereproduce.jsonwith the baseline commit, command argument arrays, artifact path, observed result, outcome, and your agent identity. Setfinding.statustoreproducedornot_reproducedfrom the result. If reproduction isblocked, leavefinding.statusashypothesis.
{
"schema_version": 1,
"failure_type": "runtime",
"outcome": "reproduced",
"baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"build_argv": ["python", "build.py"],
"poc_argv": ["python", "poc.py"],
"target_artifact": "dist/app.py",
"observed": "The PoC wrote outside uploads after PATCH_REACHED.",
"blocker": null,
"agent": "reproducer-1"
}
- Manifest the complete
reproduce/directory, including the PoC and record, using the record helper: runuv run --no-project <script> manifest <reproduce-step-dir>. Then check the record before handoff. Stateblockedwith the actual failure when build or setup prevents a valid run.
Rationalizations to Reject
| Shortcut | Required action | | --- | --- | | A unit test imitates the bug. | Exercise the target compiler or built runtime artifact. | | A nonzero exit proves reproduction. | Require the target diagnostic, or runtime marker and assertion. |
Related Skills
algorithmic-art
177.9kCreating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems.
pptx
177.9kUse this skill any time a .pptx or .potx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx or .potx file (even if the extracted content will be used elsewhere, like in an em…
design
137.2kComprehensive design skill: brand identity, design tokens, UI styling, logo generation (55 styles, Gemini, Atlas Cloud, or MuAPI AI), corporate identity program (50 deliverables, CIP mockups), HTML presentations (Chart.js), banner design (22 styles, social/ads/web/print), icon design (15 styles, SVG…
ui-ux-pro-max
137.2kUI/UX design intelligence for web, mobile, and desktop. This skill should be used when designing, building, reviewing, or fixing interfaces, including pages, components, design systems, accessibility, interaction, responsive layout, typography, color, charts, and stack-specific UI implementation.
Languages
Trust signals
From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.
