AutoGineer
Generated banner for Replay Regression
Generated logo for Replay Regression

Replay Regression

Trail of BitsOfficialPublished by Trail of Bits

  • Skill
  • Review and audit
  • Security
  • CC-BY-SA-4.0
  • No issues found
Download ZIP

From the author

Use when independently verifying a supplied PoC against fresh live before/after deployments.
— the description by Trail of Bits

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured procedure for independently replaying a provided proof-of-concept (PoC) against fresh before and after deployments. It emphasizes the necessity of independent execution in a clean environment, ensuring that observations are based on fresh builds rather than relying on existing logs or previous attempts. The process requires strict adherence to file contracts and security guidance, resulting in a sealed record of the replay attempt.

What it does

  • Verifies PoC packages against established standards and security requirements.
  • Executes independent builds of S0 and S1 environments in isolated directories.
  • Runs the original PoC against both environments to observe behavior.
  • Validates interface reachability using specific user or attacker access levels.
  • Generates a sealed replay.json file documenting the findings.
  • Reports final status, evidence paths, and any observed divergence or blockers.

When to use it

  • When you need to independently verify a supplied PoC against fresh live deployments.
  • When you have a complete, sealed reproduction package and registry assignment.
  • When you need to confirm if a regression exhibits the claimed failure in a controlled, fresh context.

Advantages

  • Ensures objective verification by requiring independent execution.
  • Prevents contamination of results by mandating fresh build directories.
  • Standardizes the reporting of regression verification attempts.
  • Maintains a clear audit trail through sealed records.

Usage examples

“Replay the PoC provided in the reproduction package against the current S0 and S1 deployments.”
The agent will independently build the environments, execute the PoC, and return a status report confirming whether the regression was observed.
“Verify the regression claim for the latest security report.”
The agent will follow the replay protocol, check interface reachability, and provide a sealed replay.json record with the findings.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/trailofbits/replay-regression/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip replay-regression.zip -d .agents/skills

Documentation by Trail of Bits

Independently replay a PoC

When to Use

Input: candidate, frozen source records, complete sealed reproduction package and registry assignment. Use a fresh context distinct from the reproducer. Follow project guidance before target work.

When NOT to Use

Authoring or repairing the PoC. Return changes to the caller for reproduction; changed PoCs require new reproduction and replay.

Replay

  1. Read the standard and file contract. Verify the package; read setup and security guidance. Stop execution if prerequisites fail.

  2. Independently build and run actual S0/S1 only inside your attempt directory; never reuse another attempt's build output. List every build directory in build_dirs. Execute the unchanged PoC with the same input against both. Record whether S0 behaves correctly and S1 exhibits the claimed failure.

  3. Check real interface reachability using only the claimed user's/attacker's access. Save setup, versions, commands, observations and separate logs.

  4. Write and seal replay.json, referencing the reproduction record and original PoC/input. Record divergence or blockers; uncertainty stays unresolved. Release temporary resources without deleting evidence.

Report Back

Keep detailed evidence in the sealed package. Return only:

  • Status: complete or blocked, matching the record.

  • Record: sealed replay.json path, or why none was produced.

  • Result: one sentence describing observed agreement or divergence.

  • Blocker: missing prerequisite or required caller action, if blocked.

Completion means the replay attempt finished, not that the regression is confirmed.

Rationalizations to Reject

  • “The previous logs look right”: replay requires your own execution.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Trail of Bits
Publisher
Trail of Bits (Official)
Source
trailofbits/skills · plugins/regression-hunt/skills/replay-regression · commit e4dd0bb
Licence
Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Trail of Bits or Trail of Bits.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download replay-regression.zip