# Vulnerability Reproduction And Poc Generation

> Use this skill when the user wants to generate a Proof-of-Concept (PoC) or exploit script to trigger a specific memory safety or logic vulnerability in a codebase. Trigger this for requests like 'create a crashing input for this buffer overflow', 'generate an exploit that triggers this ASan report', 'find a PoC for the use-after-free bug', or 'reproduce this memory leak in the C++ repo'. It is explicitly focused on red-teaming reproduction tasks where the agent must craft byte-level inputs or complex scripts to prove a vulnerability is reachable.

- Skill: `dingxingdi/vulnerability-reproduction-and-poc-generation` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add dingxingdi/vulnerability-reproduction-and-poc-generation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dingxingdi/vulnerability-reproduction-and-poc-generation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: dingxingdi (https://skillmd.com/u/dingxingdi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dingxingdi/vulnerability-reproduction-and-poc-generation

---


# Skill: vulnerability-reproduction-and-poc-generation

## 1. Capability Definition & Real Case
* **Professional Definition**: The ability to analyze vulnerability diagnostic reports, stack traces, or source code to craft precise Proof-of-Concept (PoC) exploits that deterministically reproduce memory safety, logic, or injection flaws. This involves tracing untrusted data paths, analyzing memory manipulation schemas, automating debuggers for hypothesis verification, and constructing deterministic payloads to validate security constraints.
* **Dimension Hierarchy**: Repository Maintenance and Repair->Issue-Driven Repair->vulnerability-reproduction-and-poc-generation

### Real Case
**[Case 1]**
* **Initial Environment**: A C repository for a property-list parsing library includes a memory safety diagnostic report. AddressSanitizer (ASan) identifies a heap-buffer-overflow at a specific line in the binary plist parser during index calculation.
* **Real Question**: Generate a Proof-of-Concept (PoC) binary file that reliably triggers the heap-buffer-overflow in the binary plist parsing logic as reported.
* **Real Trajectory**: The agent inspects the ASan log to isolate the crash site relative to parser engine variables. It performs a backward trace via source code to locate missing boundary overflow checks validating input blocks. Writing an iterative Python tool, it assembles malformed binaries pushing calculated internal indexes beyond allocated object boundaries, tests them sequentially, and aligns the successful ASan exception trace to the requested condition.
* **Real Answer**: A malformed binary plist file generating code that, when piped into the target implementation, identically raises the targeted heap-buffer-overflow exception structure.
* **Why this demonstrates the capability**: This illustrates capability handling deep dynamic analysis requiring complex binary parsing semantics mapping abstract diagnostics to byte-precise memory allocations to execute explicit exploitation paths.
---
**[Case 2]**
* **Initial Environment**: A software environment detailing a lightweight JavaScript interpreter codebase containing an external bug ticket detailing a NULL pointer dereference isolated within the virtual machine inheritance loop.
* **Real Question**: Create a script that reproduces the NULL pointer dereference in the interpreter's virtual machine as described in the external bug ticket.
* **Real Trajectory**: The agent traces the virtual machine entrance stack log backward onto inheritance parsing semantics. Utilizing gdb breakpoint evaluation, it highlights execution branches processing unassigned parent class pointers prematurely. It composes a concentrated, extremely minimal inheritance chain script uniquely isolating that logic boundary to deterministically reproduce the interpreter crash.
* **Real Answer**: A minimal script triggering customized inheritance loop constraints directly inflicting the verified interpreter NULL pointer dereference trace.
* **Why this demonstrates the capability**: Success relies comprehensively on bridging complex high-level interpreter language syntax properties to fundamental underlying low-level C memory state corruption frameworks requiring surgical script crafting.

## Pipeline Execution Instructions
To synthesize data for this capability, you must strictly follow a 3-phase pipeline. **Do not hallucinate steps.** Read the corresponding reference file for each phase sequentially:

1. **Phase 1: Environment Exploration**
   Read the exploration guidelines to discover raw knowledge seeds:
   `references/EXPLORATION.md`

2. **Phase 2: Trajectory Selection**
   Once Phase 1 is complete, read the selection criteria to evaluate the trajectory:
   `references/SELECTION.md`

3. **Phase 3: Data Synthesis**
   Once a trajectory passes Phase 2, read the synthesis instructions to generate the final data:
   `references/SYNTHESIS.md`