← LeaderboardThe Skill Leaderboard

implement-patch

Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.

Published by trailofbits ↗trailofbits/skills

Try your first task

Implement one independently confirmed patch

Start a fresh conversation. Replace the highlighted placeholders.

Within the parent patching-bugs run [run directory], use implement-patch for [independently confirmed finding] in [clean baseline checkout]. Read the record contract/project guidance and pass check --before-repair before editing; otherwise return INCONCLUSIVE errors. Stay inside finding.repair_scope, search the same invariant's variants, observe baseline regression failures, and make the smallest reviewable fix. Rerun focused/full suites, record variant outcomes, and create exactly one local commit, never push/PR. Deliver fix.patch, tests.patch and patch.json in patch/attempt-N, manifest/check via uv run --no-project, then await integration review.

Required inputs

run directory
independently confirmed finding
clean baseline checkout
attempt number and repair_scope

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: implement-patchdescription: Use when a confirmed local bug needs an invariant-level fix, variant search, tests, and one local commit.

Implement Patch

When to Use

Use after independent validation confirms one claim. Read the record contract. Before target commands, follow its project guidance.

When NOT to Use

Do not use for speculative bug hunting, proof of a completed patch, or a change that cannot be exercised by the local compiler or runtime.

Procedure

Before editing, run uv run --no-project <script> check --before-repair <run-dir> with the record validator. If this check fails, stop and return its errors for an INCONCLUSIVE report. The gate requires finding.repair_scope with a usable case plan and a consistent attempt count. Use the declared scope as the repair brief. Identify the broken invariant and search within its boundary for every instance of the same violation. Read the threat model only to preserve intended behavior; it is not a gate.
Run the project's existing suite and record its results. Write a regression test that fails on the baseline for the named bug and any fixed variant. Observe the failure. Fix the invariant within the repair brief with the smallest reviewable change.
Run the regression test and full existing suite again. Compare before and after failures. Fix new failures or explain a pre-existing one from receipts.
Record every variant as fixed or not_fixed with a reason. Produce exactly one local commit. Never push or open a PR. From the baseline, write fix.patch for production changes and tests.patch for test changes in patch/attempt-N/.
Write patch.json with the two commit SHAs, changed-file and line counts, variants, suite results, and your agent identity. If the attempt produced no commit, record patch_commit: null and return it as failed. Manifest the entire attempt directory, including both patch files and the record, using uv run --no-project <script> manifest <patch-attempt-dir>. Check it with the record validator.

Patch record schema:

{
  "schema_version": 1,
  "attempt": 1,
  "baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
  "patch_commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
  "files_changed": 2,
  "lines_added": 3,
  "lines_removed": 1,
  "variants": [],
  "suite_before": {"command": "pytest", "passed": 9, "failed": 1, "skipped": 0},
  "suite_after": {"command": "pytest", "passed": 10, "failed": 0, "skipped": 0},
  "agent": "patcher-1"
}

Rationalizations to Reject

Shortcut	Required action
Only the reported line matters.	Search for the same invariant violation.
Minimal means the fewest lines.	Make the smallest reviewable invariant-level fix.
Tests pass after the patch.	Show the regression test failed before it.