SkillAgentSearch skills...

reproduce-bug

Use when a named runtime or compiler bug in a local repository needs independent reproduction.

Install / Use

npx skills add trailofbits/skills --skill reproduce-bug

Installs into whichever agent you are using.

About this skill
📄

SKILL.md

Installable skill definition

Quality Score

83/100

Category

Legal

Supported Platforms

Universal

Tags

Our assessment of reproduce-bug

reproduce-bug scores 83/100 on our quality scale, 162nd of 222 Legal skills we index.

Its SKILL.md is 2.8 KB long, split into 5 sections with 1 code example: a solid amount of guidance for an agent.

With 7,225 GitHub stars, it is one of the more widely adopted skills in the catalogue.

Substance
26/30
Structure
15/20
Description
12/15
Adoption
16/20
Freshness
15/15

Maintenance, license and trust

  • The repository was last updated 27 days ago, so reproduce-bug is actively maintained.
  • It is released under the CC-BY-SA-4.0 license; check its terms before commercial use.
  • Its trust signals score 100/100, with no cautions. These come from repository metadata, not a code audit — read the skill file before letting an agent act on it.

reproduce-bug compared with similar skills

All 4 of these similar skills score higher than reproduce-bug; compare them before choosing.

SkillScoreStarsUpdatedFormat
reproduce-bug (this skill)by trailofbits837.2k27d agoSKILL.md
algorithmic-artby anthropics100177.9k28d agoSKILL.md
pptxby anthropics100177.9k28d agoSKILL.md
designby nextlevelbuilder100137.2k6d agoSKILL.md
ui-ux-pro-maxby nextlevelbuilder100137.2k6d agoSKILL.md

Frequently asked questions

How do I install reproduce-bug?
Run npx skills add trailofbits/skills --skill reproduce-bug. The install tabs above show the steps for each supported agent.
Which AI agents does reproduce-bug work with?
It is written for Universal, as a SKILL.md file. Other agents that read the same format can often use it too.
Is reproduce-bug safe to use?
It is CC-BY-SA-4.0-licensed and scores 100/100 on trust signals. Skills are instructions an agent will follow, so read the file before installing it and do not approve commands you do not understand.
Is reproduce-bug still maintained?
The repository was last updated 27 days ago, so reproduce-bug is actively maintained.

name: reproduce-bug description: Use when a named runtime or compiler bug in a local repository needs independent reproduction.

Reproduce Bug

When to Use

Use for the reproduction step of patching-bugs with one finding.json and a local baseline checkout. Read the record contract. Before target commands, follow its project guidance.

When NOT to Use

Do not use for bug discovery, patching, or a claim that cannot be exercised locally. Report a blocker when the build or environment cannot exercise the claim.

Procedure

  1. Select failure_type from the record contract. Build the current baseline with the project's own command. Exercise the planned scoped inputs before any edit and retain their observations, including valid controls. Save raw stdout, stderr, exit status, and timing. If the behavior is absent with trustworthy evidence, report not_reproduced; if setup or observations are unreliable, report blocked.

  2. Runtime: exercise the built target_artifact with a PoC that records PATCH_LOADED as defined in the contract, then prints PATCH_REACHED immediately before the assertion. Exit nonzero for the bug, zero otherwise; a setup crash is inconclusive. Compile: record the target expected_diagnostic from the failed compiler invocation; use empty poc_argv and null target_artifact.

  3. Save any unchanged PoC source under reproduce/poc/ and raw receipts under reproduce/receipts/. Write reproduce.json with the baseline commit, command argument arrays, artifact path, observed result, outcome, and your agent identity. Set finding.status to reproduced or not_reproduced from the result. If reproduction is blocked, leave finding.status as hypothesis.

    Reproduce record schema:

{
  "schema_version": 1,
  "failure_type": "runtime",
  "outcome": "reproduced",
  "baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "build_argv": ["python", "build.py"],
  "poc_argv": ["python", "poc.py"],
  "target_artifact": "dist/app.py",
  "observed": "The PoC wrote outside uploads after PATCH_REACHED.",
  "blocker": null,
  "agent": "reproducer-1"
}
  1. Manifest the complete reproduce/ directory, including the PoC and record, using the record helper: run uv run --no-project <script> manifest <reproduce-step-dir>. Then check the record before handoff. State blocked with the actual failure when build or setup prevents a valid run.

Rationalizations to Reject

| Shortcut | Required action | | --- | --- | | A unit test imitates the bug. | Exercise the target compiler or built runtime artifact. | | A nonzero exit proves reproduction. | Require the target diagnostic, or runtime marker and assertion. |

Related Skills

View on GitHub
GitHub Stars7.2k
CategoryLegal
Updated27d ago
Forks615

Languages

Python

Trust signals

100/100

From repository metadata: license, adoption, age and documentation. Not a code audit — see the Safety scan above for what the skill file itself contains.

No cautions
reproduce-bug — Universal Skill: Install & Safety Check | SkillAgent