Validate Bug

From the author

Use when a bug PoC package needs an independent rerun and judgment before patching.

— the description by Trail of Bits

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Validate Bug provides a structured procedure for security agents to independently rerun and assess bug proof-of-concept (PoC) packages. By isolating the verification process from the original reporter's narrative, it ensures that findings are objectively confirmed, not confirmed, or marked as inconclusive based on raw execution data and adherence to project invariants.

What it does

Reviews finding documentation and PoC materials independently.
Executes baseline compiler commands or runtime PoCs in a controlled environment.
Captures and archives stdout, stderr, exit status, and timing data.
Evaluates whether the observed behavior violates stated project invariants.
Generates a formal validation record with a confirmed or inconclusive status.
Manifests validation results for audit and record-keeping purposes.

When to use it

After a bug has been reproduced and a PoC package is available.
When an independent verification of a security claim is required before patching.
When you need to ensure that a reported bug is reproducible without relying on external transcripts.

Advantages

Prevents reliance on potentially flawed or biased reproduction narratives.
Ensures consistent and auditable verification of security findings.
Maintains strict separation between bug validation and patch development.
Provides clear, standardized outcomes for bug triage.

Usage examples

“Validate the bug PoC provided in the latest finding.”: The agent will independently rerun the PoC, capture the execution receipts, and generate a validate.json file confirming or rejecting the bug claim.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/trailofbits/validate-bug/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip validate-bug.zip -d .agents/skills

Documentation by Trail of Bits

When to Use

Use after reproduce-bug has supplied a finding and PoC package. Read the record contract. Before target commands, follow its project guidance.

When NOT to Use

Do not use to repair a PoC, develop a patch, or infer reproduction from the reproducer's narrative.

Procedure

Read finding.json, the reproduction's proof type, commands, any PoC, and raw receipts. Do not read the reproducer's transcript.
Rerun the same baseline compiler command for compile failures, or rebuild and rerun the unchanged runtime PoC and planned scoped inputs. Save stdout, stderr, exit status and timing in validate/receipts/. If an observation is unreliable, return inconclusive instead of inferring either presence or absence.
Decide whether the target diagnostic or runtime assertion demonstrates the exact claim and violates the stated invariant. Write validate.json as confirmed, not_confirmed, or inconclusive with a short reason and agent identity.
Validate record schema:

{
  "schema_version": 1,
  "outcome": "confirmed",
  "agent": "validator-1",
  "reason": "The unchanged PoC reached the assertion and demonstrated the claim."
}

Manifest the complete validate/ directory with uv run --no-project <script> manifest <validate-step-dir>, then run the record checker. Return the package without editing the PoC or finding.

Rationalizations to Reject

Shortcut	Required action
Fix the PoC to make the claim work.	Mark it inconclusive and explain why.
Trust the reproducer's conclusion.	Rerun the unchanged package independently.

Files

ATTRIBUTION.mdAdded by AutoGineer931 B
LICENSELicence file added by AutoGineer19.7 KiB
SKILL.md1.9 KiB

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k