# Post Patch Validation

Validates security patches with reproducible baseline-versus-patched evidence...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Security
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add trailofbits/skills --skill post-patch-validation -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill post-patch-validation -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill post-patch-validation -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill post-patch-validation -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging, or reporting it as fixed; also use when an AI-generated patch, remediation commit, pull request, or proposed upstream fix needs adversarial post-patch validation across any language.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Post-Patch Validation

Validate a security patch against the reported bug and the surrounding code it affects. Give the
patch author reproducible failures to fix and identify what still needs testing. Apply the same
checks to human and agent patches. The diff, author, upstream implementation, and original proof
of concept alone cannot establish correctness.

## When to Use

- A security fix, remediation commit, patch file, or pull request already exists.
- An AI-generated patch needs validation before human review or merge.
- A fix may cover one exploit path while missing variants of the same root cause.
- A security fix may alter legitimate behavior or introduce a new vulnerability.
- A patch author needs concrete failures and coverage gaps before another revision.

## When NOT to Use

- No patch exists yet; use vulnerability discovery or fix implementation first.
- The task is to review an audit finding against a report without executing patch evidence.
- The task is only to convert a finding into a permanent project test.
- The target is remote or production. This skill executes local code and tests only.
- The user has not authorized execution of the repository's code or test suite.

## Quick Start

1. Pin the vulnerable base and patched input. Prefer immutable commits. For uncommitted work,
   create a binary patch file first; do not validate in the user's working tree.
2. Scaffold a pinned plan:

   ```bash
   uv run {baseDir}/scripts/post_patch_validation.py scaffold \
     --repo . \
     --base-ref <vulnerable-ref> \
     --patched-ref <patched-ref> \
     --finding-id <stable-id> \
     --finding-summary "<root cause and impact>" \
     --evidence-level runtime \
     --output post-patch-validation/plan.json
   ```

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/post-patch-validation/skills/post-patch-validation/SKILL.md