Adjudicate Regression
Trail of BitsOfficialPublished by Trail of Bits
- Skill
- Review and audit
- Security
- CC-BY-SA-4.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The adjudicate-regression skill provides a rigorous framework for evaluating evidence to determine if a software change has introduced a new regression. It requires the agent to analyze source code, reproduction packages, and logs to distinguish between genuine regressions, latent bugs, intentional changes, or unsupported expectations. The process emphasizes independent verification and evidence-based decision-making, ensuring that findings are properly categorized and documented in a sealed record.
What it does
- Verifies evidence seals and inspects source, setup, and logs for claimed defects.
- Assesses whether a specific change introduced the defect or if it is a pre-existing issue.
- Validates reproduction and replay results against live interfaces.
- Assigns severity and likelihood to confirmed regressions.
- Identifies exclusions or unresolved gaps when evidence is insufficient.
- Produces a sealed decision record with cited evidence for every conclusion.
When to use it
- When you need to determine if a reported defect is a new regression or an exclusion.
- When evaluating candidate evidence against frozen sources and reproduction packages.
- When you need to deduplicate multiple claims based on a shared root cause.
- When you must distinguish between a new regression and a latent, pre-existing bug.
Advantages
- Ensures consistent and rigorous evaluation of regression claims.
- Prevents misclassification of latent bugs as new regressions.
- Provides a clear, evidence-backed audit trail for every decision.
- Standardizes the reporting of unresolved gaps and missing evidence.
Usage examples
- “Adjudicate the regression claim for the provided candidate and reproduction package.”
- The agent reviews the evidence, verifies the reproduction against live interfaces, and returns a status of complete with a sealed decision.json confirming or excluding the regression.
- “Determine if these two reported issues share a root cause.”
- The agent analyzes the provided candidates and mappings to establish if they are duplicates or distinct issues, preserving the integrity of the regression report.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/trailofbits/adjudicate-regression/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip adjudicate-regression.zip -d .agents/skills
Documentation by Trail of Bits
Adjudicate evidence
When to Use
Input: candidate, frozen sources, available reproduction/replay packages and registry assignment. Use a fresh context distinct from the reproducer and replayer. Early exclusions may lack experiments. Follow project guidance before target work.
When NOT to Use
Producing missing evidence; return the gap to the caller.
Decide
Read the standard, labels and file contract. Verify seals. Inspect source, setup, PoC, actual logs and security assumptions, not only summaries.
Identify the claimed defect and assess whether the change introduced it. Rule out incomplete fixes, latent/pre-existing bugs, intentional changes, unsupported expectations and unreachable scenarios with cited evidence. Establish attacker access and applicable protections for security findings.
Confirm only when reproduction and independent replay ran the same PoC/input against live S0/S1 through real interfaces, showing correct behavior before and failure afterward. Explain supported behavior, reachability and patch causality. Assign severity/likelihood with reasons.
Otherwise select an evidenced exclusion or
UNRESOLVED; state what remains unproved. ForUNRESOLVED, put the standard's concise paragraph separating observed gaps, plausible explanations and resolving checks inreasonso reports retain it. Incomplete fixes and existing bugs stay outside regression totals. Check known findings/issues/PRs before claiming novelty; report unknown if unavailable.For requested deduplication, establish whether supplied candidates share a root cause. Preserve change mappings; never deduplicate unresolved claims into confirmation.
Write and seal
decision.json; cite evidence for every conclusion. Record any blocker preventing adjudication.
Report Back
Keep detailed reasoning in the sealed package. Return only:
Status:
completeorblocked, matching the record.Record: sealed
decision.jsonpath, or why none was produced.Result: outcome and one-sentence reason.
Gap: missing evidence or required caller action, if any.
A completed decision may be UNRESOLVED; task status and finding outcome differ.
Rationalizations to Reject
“S0 passes and S1 fails”: exposing an existing defect is a latent bug.
Files
- ATTRIBUTION.mdAdded by AutoGineer951 B
- LICENSELicence file added by AutoGineer19.7 KiB
- SKILL.md2.6 KiB
SKILL.md
Adjudicate evidence
When to Use
Input: candidate, frozen sources, available reproduction/replay packages and registry assignment. Use a fresh context distinct from the reproducer and replayer. Early exclusions may lack experiments. Follow project guidance before target work.
When NOT to Use
Producing missing evidence; return the gap to the caller.
Decide
Read the standard, labels and file contract. Verify seals. Inspect source, setup, PoC, actual logs and security assumptions, not only summaries.
Identify the claimed defect and assess whether the change introduced it. Rule out incomplete fixes, latent/pre-existing bugs, intentional changes, unsupported expectations and unreachable scenarios with cited evidence. Establish attacker access and applicable protections for security findings.
Confirm only when reproduction and independent replay ran the same PoC/input against live S0/S1 through real interfaces, showing correct behavior before and failure afterward. Explain supported behavior, reachability and patch causality. Assign severity/likelihood with reasons.
Otherwise select an evidenced exclusion or
UNRESOLVED; state what remains unproved. ForUNRESOLVED, put the standard's concise paragraph separating observed gaps, plausible explanations and resolving checks inreasonso reports retain it. Incomplete fixes and existing bugs stay outside regression totals. Check known findings/issues/PRs before claiming novelty; report unknown if unavailable.For requested deduplication, establish whether supplied candidates share a root cause. Preserve change mappings; never deduplicate unresolved claims into confirmation.
Write and seal
decision.json; cite evidence for every conclusion. Record any blocker preventing adjudication.
Report Back
Keep detailed reasoning in the sealed package. Return only:
Status:
completeorblocked, matching the record.Record: sealed
decision.jsonpath, or why none was produced.Result: outcome and one-sentence reason.
Gap: missing evidence or required caller action, if any.
A completed decision may be UNRESOLVED; task status and finding outcome differ.
Rationalizations to Reject
“S0 passes and S1 fails”: exposing an existing defect is a latent bug.
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Trail of Bits
- Publisher
- Trail of Bits (Official)
- Source
- trailofbits/skills · plugins/regression-hunt/skills/adjudicate-regression · commit e4dd0bb
- Licence
- Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
AutoGineer is not affiliated with or endorsed by Trail of Bits or Trail of Bits.
Related skills
Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude CodeMITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude CodeMITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 moreMITLow riskGitHub stars of the source repository42.3k
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download adjudicate-regression.zip