AI agent skill · by @Leanmcp

Security Repro

Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.

Archived 2026-10-23 · Source updated 2026-10-07 · License: MIT. Check the original repository for the latest version.

SKILL.md instructions

# security-repro

Reproduce **already-fixed, publicly disclosed** vulnerabilities so a reader can
see the failure mode and confirm the vendor's patch closes it. The audience is
a whitepaper or an internal control test. The output is a contrast: the
vulnerable behavior fires, the patched behavior refuses, and nothing real is
touched.

## The one hard line (read first)

This skill exists to reproduce **the past**, not to find **the new**. Everything
below flows from that.

- **Only patched or withdrawn issues.** If the vendor has not shipped a fix (or
  pulled the artifact), stop. Do not proceed on an open/unpatched issue, even a
  disclosed one.
- **Use the last known-vulnerable public version** that is already on the
  internet — the release *before* the fix. You are demonstrating something that
  already exists publicly, not creating it.
- **Never develop new exploitation.** No fuzzing for new bugs, no chaining, no
  variant discovery, no bypassing an *unfixed* control. If reproducing the
  disclosed mechanism faithfully would require inventing an undisclosed step
  (e.g. an escape whose mechanism was never published), leave that step out of
  scope and say so in writing.
- **Offline, loopback, synthetic.** No third-party host, no real credential, no
  real target, no real recipient, no persistence, no exfiltration. A successful
  reproduction means a **local marker or a policy decision is observed**, not
  that code ran on someone's machine or data left the lab.

If a request pushes past this line — reproduce an unpatched bug, target real
infrastructure, weaponize a payload, evade detection — decline that part in one
sentence, explain why (it would be new zero-day / offensive work), and offer the
safe version instead. This protects the user legally; it is the whole point.

## Workflow

### 1. Establish that the issue is public AND patched

Before writing any code, pin down three facts and record them in the guide:

1. **Disclosure** — a primary source: vendor advisory, MSRC/GitHub/GitLab
   advisory, or the researcher's write-up.
2. **Fix** — the version or commit that patched it, or confirmation the artifact
   was withdrawn. This is the gate. No fix, no repro.
3. **Vulnerable version** — the last public release before the fix.

Use the helper scripts to pull machine-readable metadata:

```bash
# NVD record (CVSS, references, CWE, published/modified dates)
python3 scripts/fetch_nvd.py CVE-2025-32711

# CVE.org record (CNA description, affected versions, references)
python3 scripts/fetch_cve.py CVE-2025-32711

# Pretty one-line "is this patched?" summary across both sources
python3 scripts/check_patched.py CVE-2025-32711
```

These call only the public NVD and CVE.org REST APIs (read-only). They do not
touch any victim system. If the CVE has no `Fixed`/patched reference and no
withdrawal note, treat the patched status as **unconfirmed** and tell the user
to verify against the vendor before you build anything.

### 2. Model the mechanism minimally, not the whole kill chain

Reduce the disclosure to the single control failure worth showing, and replace
every dangerous verb with an inert marker:

| Real element | Reproduce it as |
|---|---|
| shell / `exec` / RCE | a function that writes `MARKER.txt` with a fixed string |
| credential / secret | a decoy file like `DECOY_SECRET.txt` = `not-a-real-secret` |
| exfiltration endpoint | an in-process or `127.0.0.1` loopback sink that just logs |
| email recipient | `recipient@example.invalid` |
| write outside sandbox | a **path calculation** that is asserted, never performed |
| a real vulnerable dependency | pin the real last-vulnerable version **only** if a
  primary source confirms that exact version; otherwise model the disclosed
  mechanism in two local loaders (`vulnerable_*` / `patched_*`) and say so |

Cut the parts whose mechanism was never disclosed (mark them "explicitly out of
scope"). Reconstructing an undisclosed step is new zero-day work — forbidden.

### 3. Build the vulnerable-vs-patched harness

Follow the house pattern already in `Reproducibility/` in the whitepaper repo:

- A single self-contained harness (stdlib-only Python preferred; Docker with
  `network_mode: none` when isolation must be enforced).
- Two code paths: **vulnerable** (the marker fires) and **patched** (the same
  input is refused with a decision like `block` / `review_required`).
- Deterministic output, a saved `results/run.json` (or transcript), and a
  non-zero exit if the contrast does not hold.
- Log the gateway-relevant fields: `source`, `data_class`, `outbound_channel`,
  `decision`, `policy_id`, and a short `reason`.

See `references/harness-pattern.md` for the concrete file layout, the safety
checklist, and a copyable harness skeleton.

### 4. Write the guide

Produce a short markdown guide next to the harness with these sections:
**Status and scope** (name the CVE, the fix version, and what is explicitly out
of scope), **Lab design / Reproduction protocol**, **Defensive assertion** (what
control would have caught it), **Safety limits**, and **Sources** (primary links
only). Match the tone and structure of the existing numbered guides.

### 5. Hand back run commands

Per this user's standing rule, do not execute reproduction harnesses yourself —
write them, then give the exact command to run. State clearly what a pass looks
like (which marker appears, which decision is logged).

## Scripts

- `scripts/fetch_nvd.py CVE-ID` — NVD 2.0 API record as JSON (CVSS, refs, CWE).
- `scripts/fetch_cve.py CVE-ID` — CVE.org CVE Record (CNA data, affected versions).
- `scripts/check_patched.py CVE-ID` — combines both and prints whether a fixed
  version / patch reference is present, so the "is it patched?" gate is fast.

All three are read-only, hit only public vulnerability databases, and take a
single CVE ID argument.

## References

- `references/harness-pattern.md` — file layout, safety checklist, and a
  stdlib-only harness skeleton to copy.