# post-patch-validation

Runs exploits and regression checks against both the vulnerable and patched revisions, so you can see whether a security fix actually holds.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 746 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/post-patch-validation/skills/post-patch-validation/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/post-patch-validation

## What it does

This skill takes an existing security patch and builds a validation plan around it. You pin the vulnerable base and the patched side, using commits where possible; uncommitted work gets turned into a binary patch file first, because the skill does not validate inside your working tree. The agent then reads the finding, the diff, callers, sibling paths and error handling before writing the checks.

A diff, an author name or the original proof of concept prove nothing on their own. So the plan needs at least one check of each kind: a control, the original exploit, a variant of the same root cause, unchanged behavior, a targeted regression, an adjacent-vulnerability check and the project suite. The bundled `scripts/post_patch_validation.py` offers `scaffold`, `print-schema`, `validate-plan` and `run`. Commands are argv arrays rather than shell strings, the runner pins locale, timezone and hash seed, and it never edits the original worktree. Exploit and variant checks must flush `PPV_REACHED` to stdout on both sides; a run without it leaves a `marker_missing` gap. Each check times out after 300 seconds by default, with 1 to 3600 allowed.

You need `uv` on the machine. Put complex setup in a script and call it through `{plan_dir}`. The runner only touches local code, so this is the wrong tool for a remote host or production, and running a repository's test suite still needs the owner's go-ahead.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill post-patch-validation -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/post-patch-validation/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/post-patch-validation/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill post-patch-validation -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/post-patch-validation/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill post-patch-validation -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/post-patch-validation/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills post-patch-validation
```

2. **Manually: put the files in place**
- File: `.github/skills/post-patch-validation/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill post-patch-validation -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/post-patch-validation/skills/post-patch-validation
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/post-patch-validation/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill post-patch-validation -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/post-patch-validation/skills/post-patch-validation/SKILL.md

## When to use it
- Show that a patch stops the original exploit, not just that it builds
- Catch sibling paths to the same root cause the fix missed
- Detect behavior changes caused by a security edit
- Spot a new weakness the patch itself introduced
- Hand the author failing checks and logs before the next revision

## Example prompts
- Validate the patch in `patch.diff` against commit `a1b2c3d`, scaffold a plan and run it
- Scaffold a validation plan for this fix PR and add a variant that enters through a different input
- Re-run the earlier validation and list the checks that came back as gaps

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md