Individual skill
security-repro
Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.
skills/security-repro/SKILL.md
Source commit 7a708ce17d05bd390da88b2350f4b794d9427f18
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 2,124
- Repository last updated
- Oct 7, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 6,907 bytesSKILL.mdcore · 6,907 bytesSKILL.mdcore · 6,907 bytesreferences/harness-pattern.mddoc · 2,909 bytesscripts/check_patched.pyruns · 3,027 bytesscripts/fetch_cve.pyruns · 2,030 bytesscripts/fetch_nvd.pyruns · 2,266 bytes
Read excerpt
# security-repro
Reproduce **already-fixed, publicly disclosed** vulnerabilities so a reader can
see the failure mode and confirm the vendor's patch closes it. The audience is
a whitepaper or an internal control test. The output is a contrast: the
vulnerable behavior fires, the patched behavior refuses, and nothing real is
touched.
## The one hard line (read first)
This skill exists to reproduce **the past**, not to find **the new**. Everything
below flows from that.
- **Only patched or withdrawn issues.** If the vendor has not shipped a fix (or