post-patch-validation — Claude Code skill: prove a security patch

What post-patch-validation does

This skill takes an existing security patch and builds a validation plan around it. You pin the vulnerable base and the patched side, using commits where possible; uncommitted work gets turned into a binary patch file first, because the skill does not validate inside your working tree. The agent then reads the finding, the diff, callers, sibling paths and error handling before writing the checks.

A diff, an author name or the original proof of concept prove nothing on their own. So the plan needs at least one check of each kind: a control, the original exploit, a variant of the same root cause, unchanged behavior, a targeted regression, an adjacent-vulnerability check and the project suite. The bundled scripts/post_patch_validation.py offers scaffold, print-schema, validate-plan and run. Commands are argv arrays rather than shell strings, the runner pins locale, timezone and hash seed, and it never edits the original worktree. Exploit and variant checks must flush PPV_REACHED to stdout on both sides; a run without it leaves a marker_missing gap. Each check times out after 300 seconds by default, with 1 to 3600 allowed.

You need uv on the machine. Put complex setup in a script and call it through {plan_dir}. The runner only touches local code, so this is the wrong tool for a remote host or production, and running a repository's test suite still needs the owner's go-ahead.