# Hunt Regressions

Use when discovering possible regressions from a pinned change and its callers before...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Engineering
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add trailofbits/skills --skill hunt-regressions -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill hunt-regressions -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill hunt-regressions -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill hunt-regressions -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Use when discovering possible regressions from a pinned change and its callers before reproduction.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Discover candidates

## When to Use

Input: sealed preparation, frozen S0/S1, change context and registry assignment.
On retry, include this assignment's prior candidate-ID mapping. The caller supplies
these, including for independent use.
Follow [project guidance](../../references/evidence.md#project-guidance) before target work.

## When NOT to Use

Proving a known candidate; use reproduction. Discovery cannot confirm findings.

## Hunt

1. Read the [standard](../../docs/regression-definition.md) and
   [file contract](../../references/evidence.md). Verify preparation; read frozen
   change messages, PR discussion and security documentation for intent and supported use.
2. Review the entire diff; trace changed behavior through callers to real interfaces.
   Use frozen sources and supplied context, not later fixes, advisories or other reviews.
3. Record each lead's changed code, previously supported behavior, reachable trigger,
   proposed new defect, false-positive checks and required proof. Retain supplied
   leads suggesting old bugs or incomplete fixes for adjudication.
   Leave PoC construction to reproduction.
4. Reserve each lead's ID through [registry.py](../../scripts/registry.py) `candidate`
   using its stable hypothesis key and assigned agent handle. Reuse the key on retry.
   Write candidate files and `hunt.json` with IDs, file mappings, coverage and limitations.
   An empty list is valid.
   If blocked, record partial coverage and uninspected areas. Seal the package.

## Report Back

Keep detailed evidence in the sealed package. Return only:

- Status: `complete` or `blocked`, matching the record.
- Record: sealed `hunt.json` path, or why none was produced.
- Result: candidate count and material coverage gaps.
- Blocker: missing prerequisite or required caller action, if blocked.

## Rationalizations to Reject

- “A helper fails on invented input”: show a supported interface that reaches it.