Reproduce Bug
Read the record contract.
Install
/plugin install trailofbits/skills/plugins/patching-bugs Run in Claude Code to add the Patching Bugs plugin, then enable this skill.
When to Use
Use for the reproduction step of patching-bugs with one finding.json and a local
baseline checkout. Read the record contract.
Before target commands, follow its project guidance.
When NOT to Use
Do not use for bug discovery, patching, or a claim that cannot be exercised locally. Report a blocker when the build or environment cannot exercise the claim.
Procedure
Select
failure_typefrom the record contract. Build the current baseline with the project's own command. Exercise the planned scoped inputs before any edit and retain their observations, including valid controls. Save raw stdout, stderr, exit status, and timing. If the behavior is absent with trustworthy evidence, reportnot_reproduced; if setup or observations are unreliable, reportblocked.Runtime: exercise the built
target_artifactwith a PoC that recordsPATCH_LOADEDas defined in the contract, then printsPATCH_REACHEDimmediately before the assertion. Exit nonzero for the bug, zero otherwise; a setup crash is inconclusive. Compile: record the targetexpected_diagnosticfrom the failed compiler invocation; use emptypoc_argvand nulltarget_artifact.Save any unchanged PoC source under
reproduce/poc/and raw receipts underreproduce/receipts/. Writereproduce.jsonwith the baseline commit, command argument arrays, artifact path, observed result, outcome, and your agent identity. Setfinding.statustoreproducedornot_reproducedfrom the result. If reproduction isblocked, leavefinding.statusashypothesis.
{
"schema_version": 1,
"failure_type": "runtime",
"outcome": "reproduced",
"baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"build_argv": ["python", "build.py"],
"poc_argv": ["python", "poc.py"],
"target_artifact": "dist/app.py",
"observed": "The PoC wrote outside uploads after PATCH_REACHED.",
"blocker": null,
"agent": "reproducer-1"
}
- Manifest the complete
reproduce/directory, including the PoC and record, using the record helper: runuv run --no-project <script> manifest <reproduce-step-dir>. Then check the record before handoff. Stateblockedwith the actual failure when build or setup prevents a valid run.
Rationalizations to Reject
| Shortcut | Required action |
|---|---|
| A unit test imitates the bug. | Exercise the target compiler or built runtime artifact. |
| A nonzero exit proves reproduction. | Require the target diagnostic, or runtime marker and assertion. |
More in Patching Bugs
- Implement Patch Use after independent validation confirms one claim.
- Patching Bugs See the record contract before creating the run directory.
- Prove Patch Use the original baseline, final patch commit, declared repairscope, and unchanged reproduction package.
- Validate Bug Use after reproduce-bug has supplied a finding and PoC package.