implement-patch skill
Fixes confirmed local bugs by implementing invariant-level repairs, writing regression tests, and generating structured patch records.
- GitHub stars
- 8,136
- Files
- 1
- Last commit
- Nov 11, 2026
- License
- CC-BY-SA-4.0
- Allowed tools
- —
What does the implement-patch skill do?
implement-patch is an agent skill. Fixes confirmed local bugs by implementing invariant-level repairs, writing regression tests, and generating structured patch records.
Summary generated from the skill's SKILL.md.
About the implement-patch skill
Repairing confirmed local bugs through invariant-level fixes and regression testing is the primary function of this skill. Developers use it when a bug has already been independently validated and requires a structured repair process rather than speculative hunting. The agent follows a strict procedure that begins by running a check with the record validator using uv run to ensure the repair scope and case plan are usable.
Once the broken invariant is identified, the agent searches for all instances of the violation within its boundary. It writes a regression test that fails on the baseline before applying the smallest reviewable change to fix the invariant. The process concludes by generating two specific files, fix.patch and tests.patch, inside a patch directory. Finally, the agent produces a patch.json record containing commit SHAs, file statistics, and suite results, which is then manifested using the manifest command and verified with the record validator.
What an agent can do with it
- 1Fixing validated local bugsApply an invariant-level repair to a bug that has already been confirmed through independent validation.
- 2Creating regression testsDevelop a new test that fails on the current baseline to ensure the bug and its variants are addressed.
- 3Generating structured patch recordsProduce a patch.json file containing commit details, changed line counts, and test suite results.
- 4Searching for invariant violationsIdentify every instance of a specific violation within the boundaries of a broken invariant.
Written from the skill's SKILL.md. Every use case is checked against a quote from it.
How to install the implement-patch skill
Each command copies the skill folder into the client's skills directory. Restart the client or start a new session to load it.Install the implement-patch skill in Plugin
/plugin marketplace add trailofbits/skills /plugin install patching-bugs@trailofbits
Install the implement-patch skill in Claude Code
~/.claude/skills/implement-patch/SKILL.md
$ npx degit trailofbits/skills/plugins/patching-bugs/skills/implement-patch ~/.claude/skills/implement-patchInstall the implement-patch skill in Claude Code (project)
.claude/skills/implement-patch/SKILL.md
$ npx degit trailofbits/skills/plugins/patching-bugs/skills/implement-patch .claude/skills/implement-patchInstall the implement-patch skill in Codex
~/.agents/skills/implement-patch/SKILL.md
$ npx degit trailofbits/skills/plugins/patching-bugs/skills/implement-patch ~/.agents/skills/implement-patchInstall the implement-patch skill in Gemini CLI
~/.gemini/skills/implement-patch/SKILL.md
$ npx degit trailofbits/skills/plugins/patching-bugs/skills/implement-patch ~/.gemini/skills/implement-patchInstall the implement-patch skill in Claude.ai
npx degit trailofbits/skills/plugins/patching-bugs/skills/implement-patch implement-patch && zip -r implement-patch.zip implement-patch # claude.ai → Customize → Skills → + → Create skill → Upload a skill → implement-patch.zip
SKILL.md
View on GitHubImplement Patch
When to Use
Use after independent validation confirms one claim. Read the record contract. Before target commands, follow its project guidance.
When NOT to Use
Do not use for speculative bug hunting, proof of a completed patch, or a change that cannot be exercised by the local compiler or runtime.
Procedure
-
Before editing, run
uv run --no-project <script> check --before-repair <run-dir>with the record validator. If this check fails, stop and return its errors for an INCONCLUSIVE report. The gate requiresfinding.repair_scopewith a usable case plan and a consistent attempt count. Use the declared scope as the repair brief. Identify the broken invariant and search within its boundary for every instance of the same violation. Read the threat model only to preserve intended behavior; it is not a gate. -
Run the project's existing suite and record its results. Write a regression test that fails on the baseline for the named bug and any fixed variant. Observe the failure. Fix the invariant within the repair brief with the smallest reviewable change.
-
Run the regression test and full existing suite again. Compare before and after failures. Fix new failures or explain a pre-existing one from receipts.
-
Record every variant as
fixedornot_fixedwith a reason. Produce exactly one local commit. Never push or open a PR. From the baseline, writefix.patchfor production changes andtests.patchfor test changes inpatch/attempt-N/. -
Write
patch.jsonwith the two commit SHAs, changed-file and line counts, variants, suite results, and your agent identity. If the attempt produced no commit, recordpatch_commit: nulland return it as failed. Manifest the entire attempt directory, including both patch files and the record, usinguv run --no-project <script> manifest <patch-attempt-dir>. Check it with the record validator.
{
"schema_version": 1,
"attempt": 1,
"baseline_commit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"patch_commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
"files_changed": 2,
"lines_added": 3,
"lines_removed": 1,
"variants": [],
"suite_before": {"command": "pytest", "passed": 9, "failed": 1, "skipped": 0},
"suite_after": {"command": "pytest", "passed": 10, "failed": 0, "skipped": 0},
"agent": "patcher-1"
}
Rationalizations to Reject
| Shortcut | Required action |
|---|---|
| Only the reported line matters. | Search for the same invariant violation. |
| Minimal means the fewest lines. | Make the smallest reviewable invariant-level fix. |
| Tests pass after the patch. | Show the regression test failed before it. |
Files in this skill
1implement-patch skill questions
How do I install the implement-patch skill in Claude Code?
Run npx degit trailofbits/skills/plugins/patching-bugs/skills/implement-patch ~/.claude/skills/implement-patch. Claude Code loads skills from ~/.claude/skills (all projects) or .claude/skills (one project) and uses a skill when its description matches the task.
Which clients can use the implement-patch skill?
Any client that reads the Agent Skills format: Claude Code, Codex, Gemini CLI and claude.ai (upload as a ZIP). Scripts in the skill run only where the client allows code execution.
When should I use the implement-patch skill?
Use this skill after independent validation has confirmed a bug and you need to perform an invariant-level fix, search for variants, and create a local commit.
Can I use this skill for speculative bug hunting?
No, the skill should not be used for speculative bug hunting or for proving a patch is completed.
What should I do if the initial record validator check fails?
If the check fails, you must stop and return the errors as an INCONCLUSIVE report.
Should I push my changes to a remote repository?
No, you should produce exactly one local commit and never push or open a pull request.