About reproduce-bug
reproduce-bug is a skill for testing a reported bug against a local baseline checkout. It records build and reproduction evidence in a structured package and distinguishes reproduced, absent, and blocked results.
Key features
- 01Build the project baseline
- 02Exercise scoped inputs before edits
- 03Capture process output and timing
- 04Package PoC, receipts, and result record
Use cases
- 01Reproduce a runtime bug from a PoC
- 02Verify a compiler failure against its diagnostic
Install
Copy the command and run it in a terminal.
npx skills add https:/ / github.com/ trailofbits/ skills --skill reproduce-bugAfter installing, type/reproduce-bugin Claude Code to confirm it loaded.
Details
From the project READMEReproduce Bug
When to Use
Use for the reproduction step of patching-bugs with one finding.json and a local
baseline checkout. Read the record contract.
Before target commands, follow its project guidance.
When NOT to Use
Do not use for bug discovery, patching, or a claim that cannot be exercised locally. Report a blocker when the build or environment cannot exercise the claim.
Procedure
-
Select
failure_typefrom the record contract. Build the current baseline with the project's own command. Exercise the planned scoped inputs before any edit and retain their observations, including valid controls. Save raw stdout, stderr, exit status, and timing. If the behavior is absent with trustworthy evidence, reportnot_reproduced; if setup or observations are unreliable, reportblocked. -
Runtime: exercise the built
target_artifactwith a PoC that recordsPATCH_LOADEDas defined in the contract, then printsPATCH_REACHEDimmediately before the assertion. Exit nonzero for the bug, zero otherwise; a setup crash is inconclusive. Compile: record the targetexpected_diagnosticfrom the failed compiler invocation; use emptypoc_argvand nulltarget_artifact. -
Save any unchanged PoC source under
reproduce/poc/and raw receipts underreproduce/receipts/. Writereproduce.jsonwith the baseline commit, command argument arrays, artifact path, observed result, outcome, and your agent identity. Setfinding.statustoreproducedornot_reproducedfrom the result. If reproduction isblocked, leavefinding.statusashypothesis.
{
"schema_version": 1,
"failure_type": "runtime",
"outcome": "reproduced",
"baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"build_argv": ["python", "build.py"],
"poc_argv": ["python", "poc.py"],
"target_artifact": "dist/app.py",
"observed": "The PoC wrote outside uploads after PATCH_REACHED.",
"blocker": null,
"agent": "reproducer-1"
}
- Manifest the complete
reproduce/directory, including the PoC and record, using the record helper: runuv run --no-project <script> manifest <reproduce-step-dir>. Then check the record before handoff. Stateblockedwith the actual failure when build or setup prevents a valid run.
Rationalizations to Reject
| Shortcut | Required action |
|---|---|
| A unit test imitates the bug. | Exercise the target compiler or built runtime artifact. |
| A nonzero exit proves reproduction. | Require the target diagnostic, or runtime marker and assertion. |