Individual skill
vuln-repro
End-to-end methodology for reproducing AND patching publicly disclosed, already-fixed vulnerabilities: sourcing the advisory and the fix commit, reading the patch diff, rebuilding a pinned offline lab, building a vulnerable-vs-patched contrast harness with proper controls, minimizing the trigger, designing and validating the fix, and writing it up as a blog post or whitepaper. Use this skill whenever the user wants to reproduce, demonstrate, understand, teach, or write about a known vulnerability or security incident: "reproduce this CVE", "build a repro for", "how did EchoLeak / Log4Shell / the postmark-mcp package actually work", "show me how this exploit worked", "write a blog post about this vulnerability", "set up a lab for CVE-XXXX", "pull the NVD/CVE/OSV details", or "make a PoC I can publish". Use it just as eagerly for the patching half: "how should this be fixed", "is this patch correct", "what would have caught this", "review this security fix", "write a regression test for this CVE", "how do I backport this", or "what's the right fix for this bug class" - even when the user never says the word "reproduce". Reach for it on vague asks like "help me understand this security advisory", "I want to write about this incident", or "can we test whether we were vulnerable" when a disclosed vulnerability is in play. This skill only handles ALREADY-PATCHED, publicly disclosed issues and refuses zero-day discovery, live targets, and weaponization.
skills/vuln-repro/SKILL.md
Source commit 7a708ce17d05bd390da88b2350f4b794d9427f18
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 2,124
- Repository last updated
- Oct 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- security Derived category
- writing Derived category
- testing Derived category
- testing-browser Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 14,379 bytesSKILL.mdcore · 14,379 bytesSKILL.mdcore · 14,379 bytesSKILL.mdcore · 14,379 bytesSKILL.mdcore · 14,379 bytesassets/harness_template.pyruns · 4,920 bytesreferences/harness-pattern.mddoc · 4,638 bytesreferences/patching.mddoc · 16,625 bytesreferences/sourcing.mddoc · 6,548 bytesreferences/writeup.mddoc · 5,319 bytesscripts/check_patched.pyruns · 3,015 bytesscripts/fetch_cve.pyruns · 2,026 bytesscripts/fetch_nvd.pyruns · 2,262 bytesscripts/fetch_osv.pyruns · 3,293 bytesscripts/minimize.pyruns · 4,545 bytesscripts/triage.pyruns · 6,815 bytes
Read excerpt
# vuln-repro
Reproduce a disclosed vulnerability faithfully, explain the fix that closed it,
and publish the result. The output is a controlled experiment plus an engineering
analysis, not a demo.
## The hard line, read this first
This skill reproduces **the past**. It does not discover **the new**. Everything
below depends on that distinction holding, and it is what keeps the work legal
and publishable.
- **Only patched or withdrawn issues.** A fix version, a patch commit, or a
withdrawal notice. "Reported to the vendor" and "advisory published" are not