# Customize Vuln Pipeline

Adapts a C and C++ ASAN vulnerability pipeline to another target class.

- Repository: https://github.com/anthropics/defending-code-reference-harness (7690 stars)
- Category: Security
- License: see repository
- Last updated: 2026-08-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add anthropics/defending-code-reference-harness --skill customize -g -a claude-code -y`
Codex: `npx skills add anthropics/defending-code-reference-harness --skill customize -g -a codex -y`
Cursor: `npx skills add anthropics/defending-code-reference-harness --skill customize -g -a cursor -y`
Gemini CLI: `npx skills add anthropics/defending-code-reference-harness --skill customize -g -a gemini-cli -y`

## Description

Adapt this C/C++ ASAN vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. Use when the user wants to port, migrate, retarget, customize, or fork the pipeline for something other than C/C++ memory-safety bugs, web apps, smart contracts, deserialization, ML systems, or any other domain.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Customize the vuln-pipeline

This pipeline ships as an opinionated C/C++ + AddressSanitizer demo. Its real shape is more general: **an agent crafts an input, runs a target in a sandbox, a detector fires, a second agent verifies, a third agent analyzes exploitability.** Every noun in that sentence can be swapped. Your job is to interview the user, figure out which nouns they want to swap, and rewrite the relevant files.

The existing C/C++ code is the worked example. You don't need a playbook for each domain, read what's there, understand what's generic vs. ASAN-specific, and adapt.

## STEP 1, Read the pipeline (do this BEFORE asking anything)

Skim these files so your questions are grounded:

- `README.md`, pipeline overview (recon → find → grade → judge → report)
- `harness/cli.py`, orchestration; shows how stages wire together and what lands on disk
- `harness/find.py`, `harness/grade.py`, `harness/report.py`, the three container-agent loops; mostly generic plumbing
- `harness/prompts/find_prompt.py`, `harness/prompts/grade_prompt.py`, **the C/C++-specific parts**; bug taxonomy, quality tiers, grading rubric
- `harness/prompts/report_prompt.py`, `harness/prompts/report_grader_prompt.py`, **also C/C++-specific**; exploitability sections (primitive, heap layout, escalation path) and the rubric that scores them
- `harness/prompts/judge_prompt.py`, triage prompt; keys on ASAN excerpts and memory-safety crash classes
- `harness/prompts/system_prompt.py`, authorization block; hard-codes "C/C++ target" and "sanitizer output"
- `harness/asan.py`, stack-trace parser for dedup/judge signatures; ASAN-specific regex
- `harness/artifacts.py`, `CrashArtifact`, `GraderVerdict`, `JudgeVerdict`, `ReportVerdict` data contracts
- `harness/config.py`, `targets/drlibs/config.yaml`, target config schema
- `targets/README.md`, how a target directory is structured (Dockerfile + config.yaml + entry wrapper)

The rest: https://github.com/anthropics/defending-code-reference-harness/blob/HEAD/.claude/skills/customize/SKILL.md