Generated banner for Implement Patch
Generated logo for Implement Patch

Implement Patch

Trail of BitsOfficialPublished by Trail of Bits

  • Skill
  • Workflow
  • Software development
  • CC-BY-SA-4.0
  • No issues found

From the author

Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.
— the description by Trail of Bits

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Implement Patch provides a rigorous, step-by-step procedure for addressing confirmed local bugs. It emphasizes invariant-level remediation, comprehensive variant searching, and the creation of regression tests to ensure the fix is verified against both the specific bug and the broader project suite. The workflow concludes with the generation of standardized patch files and a JSON manifest to document the repair attempt.

What it does

  • Validates the repair scope and identifies broken invariants.
  • Searches for and addresses all instances of the same invariant violation.
  • Creates and verifies regression tests against the baseline.
  • Generates standardized patch files for production and test changes.
  • Produces a JSON manifest detailing the repair attempt and results.
  • Ensures all changes are consolidated into exactly one local commit.

When to use it

  • When a local bug has been independently validated.
  • When a fix requires addressing an invariant-level issue.
  • When you need to perform a variant search to ensure complete remediation.
  • When you are ready to document a repair attempt with standardized records.

Advantages

  • Ensures consistent documentation of bug fixes via standardized manifests.
  • Promotes thoroughness by requiring variant searches beyond the reported line.
  • Validates fixes through mandatory regression testing.
  • Maintains a clean commit history by enforcing a single-commit policy per attempt.

Usage examples

“Implement a fix for the identified buffer overflow invariant violation.”
The agent will validate the scope, search for related instances, write a failing regression test, apply the fix, and generate the required patch files and manifest.
“Record the results of the latest patch attempt for the authentication bypass bug.”
The agent will manifest the patch directory and validate the attempt against the record schema.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/trailofbits/implement-patch/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip implement-patch.zip -d .agents/skills

Documentation by Trail of Bits

Implement Patch

When to Use

Use after independent validation confirms one claim. Read the record contract. Before target commands, follow its project guidance.

When NOT to Use

Do not use for speculative bug hunting, proof of a completed patch, or a change that cannot be exercised by the local compiler or runtime.

Procedure

  1. Before editing, run uv run --no-project <script> check --before-repair <run-dir> with the record validator. If this check fails, stop and return its errors for an INCONCLUSIVE report. The gate requires finding.repair_scope with a usable case plan and a consistent attempt count. Use the declared scope as the repair brief. Identify the broken invariant and search within its boundary for every instance of the same violation. Read the threat model only to preserve intended behavior; it is not a gate.

  2. Run the project's existing suite and record its results. Write a regression test that fails on the baseline for the named bug and any fixed variant. Observe the failure. Fix the invariant within the repair brief with the smallest reviewable change.

  3. Run the regression test and full existing suite again. Compare before and after failures. Fix new failures or explain a pre-existing one from receipts.

  4. Record every variant as fixed or not_fixed with a reason. Produce exactly one local commit. Never push or open a PR. From the baseline, write fix.patch for production changes and tests.patch for test changes in patch/attempt-N/.

  5. Write patch.json with the two commit SHAs, changed-file and line counts, variants, suite results, and your agent identity. If the attempt produced no commit, record patch_commit: null and return it as failed. Manifest the entire attempt directory, including both patch files and the record, using uv run --no-project <script> manifest <patch-attempt-dir>. Check it with the record validator.

    Patch record schema:

{
  "schema_version": 1,
  "attempt": 1,
  "baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "patch_commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
  "files_changed": 2,
  "lines_added": 3,
  "lines_removed": 1,
  "variants": [],
  "suite_before": {"command": "pytest", "passed": 9, "failed": 1, "skipped": 0},
  "suite_after": {"command": "pytest", "passed": 10, "failed": 0, "skipped": 0},
  "agent": "patcher-1"
}

Rationalizations to Reject

ShortcutRequired action
Only the reported line matters.Search for the same invariant violation.
Minimal means the fewest lines.Make the smallest reviewable invariant-level fix.
Tests pass after the patch.Show the regression test failed before it.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Trail of Bits
Publisher
Trail of Bits (Official)
Source
trailofbits/skills · plugins/patching-bugs/skills/implement-patch · commit e4dd0bb
Licence
Creative Commons Attribution-ShareAlike 4.0 International (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Trail of Bits.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download implement-patch.zip