SECURITY REVIEW / Trail of Bits
Post-patch validation
Requires a baseline-versus-patched evidence contract before a security fix is called done.
“Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging, or reporting it as fixed; also use when an AI-generated patch, remediation commit, pull request, or proposed upstream fix needs adversarial post-patch validation across any language.”
01 / THE REASONING
Why this made the selection.
- The description says to use it after a patch exists and before accepting it as fixed.
- A heading names an Evidence Contract rather than a vibe check.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/post-patch-validation/skills/post-patch-validation/SKILL.md
- README.md
- LICENSE
Our findings
- Headings include When NOT to Use and Reading the result.
- The description covers regressions and newly introduced failures, not only the original bug.
- The definition documents side-blind checks, minimal environments, the stdout reach marker and distinct finding-versus-gap outcomes; the runner implementation was not newly inspected in this wave.
- The definition specifies control, exploit, variant, behavior, regression, security and suite checks, and describes incomplete plans as validation failures.
Not established by this review
- The skill was not executed inside a host agent.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- In Claude Code, add the upstream marketplace, then use /plugin menu to select the post-patch-validation plugin. Adding a marketplace alone does not install a plugin.
- The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow.
- Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task.
Before you start
- The complete post-patch-validation plugin, uv/Git, pinned base and patch inputs, and authorization to execute target code in an appropriate sandbox.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/post-patch-validation/skills/post-patch-validation/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: Redistribution terms
- Install instructions ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md
Supports: Documented install path