Skills for Real Engineers. Straight from my .agents directory.
39 skills
vuln-repro
Agent skill from
End-to-end methodology for reproducing AND patching publicly disclosed, already-fixed vulnerabilities: sourcing the advisory and the fix commit, reading the patch diff, rebuilding a pinned offline lab, building a vulnerable-vs-patched contrast harness with proper controls, minimizing the trigger, designing and validating the fix, and writing it up as a blog post or whitepaper. Use this skill whenever the user wants to reproduce, demonstrate, understand, teach, or write about a known vulnerability or security incident: "reproduce this CVE", "build a repro for", "how did EchoLeak / Log4Shell / the postmark-mcp package actually work", "show me how this exploit worked", "write a blog post about this vulnerability", "set up a lab for CVE-XXXX", "pull the NVD/CVE/OSV details", or "make a PoC I can publish". Use it just as eagerly for the patching half: "how should this be fixed", "is this patch correct", "what would have caught this", "review this security fix", "write a regression test for
How to install vuln-repro
install vuln-repro
# install the gateway-skills pack with the skills CLI
npx skills add Leanmcp/gateway-skills# or add only this skill to Claude Code: copy the folder
skills/vuln-repro/
# into
~/.claude/skills/vuln-repro/ (all projects)
.claude/skills/vuln-repro/ (one project)
1# vuln-repro23Reproduce a disclosed vulnerability faithfully, explain the fix that closed it,4and publish the result. The output is a controlled experiment plus an engineering5analysis, not a demo.67## The hard line, read this first89This skill reproduces **the past**. It does not discover **the new**. Everything10below depends on that distinction holding, and it is what keeps the work legal11and publishable.1213- **Only patched or withdrawn issues.** A fix version, a patch commit, or a14 withdrawal notice. "Reported to the vendor" and "advisory published" are not15 patched. No fix, no repro. Stop and say so.16- **Use the last public vulnerable version**, pulled from the ordinary public17 channel. You are studying something already on the internet.18- **Never develop new exploitation.** No fuzzing for new bugs, no chaining, no19 variant hunting against unfixed code, no bypassing a control the vendor has20 not fixed. If faithful reproduction would require inventing an undisclosed21 step, leave that step out and write down that you did.22- **Offline, loopback, synthetic.** No third-party host, no real credential, no23 real target or recipient, no persistence, no exfiltration. Success means a24 local marker appears or a policy decision is logged, never that code ran on25 someone's machine or data left the lab.2627When a request crosses the line, decline that specific part in one sentence, say28why (it would be new offensive work), and offer the safe version. Do not29…
Excerpt shown under the repository's MIT license.
More skills in gateway-skills
Keep exploring
Similar skill repositories
An agentic skills framework & software development methodology that works.
15 skills
A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.
CC1 skill
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
An AI skill that provides design intelligence for building professional UI/UX across multiple platforms.
CCCXCUGH6 skills