How do I install the Kernel Execution Flow skill?

Run npx skillmds@latest add gvago/kernel-execution-flow in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Kernel Execution Flow safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Kernel Execution Flow?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Kernel Execution Flow free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Kernel Execution Flow?

gvago (@gvago) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Kernel Execution Flow by gvago — Agent Skill

Name: Kernel Execution Flow
Author: gvago

Kernel Execution Flow

Use when a Linux kernel PR diff changes C/Rust control flow, traces execution statically (Sashiko stage 3): broken error paths, NULL derefs, uninitialized or stale values, off-by-one loop logic, preprocessor/linkage hazards in the CHANGED code only. Part of the linux-kernel-review suite.

gvago 06497e2 3 files · 27.4 KB Updated Sep 17, 2026

File contents

kernel-execution-flow

Lens for control-flow and logic verification (Sashiko stage 3). Acts as a static analysis engine tracing C (or Rust) execution flow through the diff.

How to apply

Trace every branch, switch, loop, and goto in the changed code.
Explore every error handling path (goto cleanup;) and prove it behaves correctly under failure.
Never make assumptions from return types, comments, WARN_ON/BUG_ON, or error-handling patterns, verify by tracing concrete execution paths. Full tracing discipline: references/technical-patterns.md.
For deadlock/infinite-wait/crash candidates, prove the path is structurally possible, not that it fires every run. Method: references/callstack.md.

Rule index

F1. Logic errors: incorrect loop conditions, inverted tests, off-by-one in bounds, wrong operator precedence.
F2. Unhandled error paths and missing return-value checks. Checking returns of allocation, init, locking, and resource-management calls is a mandatory kernel API contract, not defensive programming. Exceptions: __init/early-boot code, debugfs APIs, teardown paths, explicit (void) casts with sound justification.
F3. NULL pointer dereference. Reading a pointer field is not a dereference; only accessing its contents is. Prove the NULL can reach the access.
F4. Preprocessor and linkage correctness: CONFIG_ prefix misspellings (e.g. HAVE_ where CONFIG_ was intended), #ifdef branch divergence, static/inline or section placement that breaks linking or loses symbols under LTO.

Mapping a finding to the contract

action_level: action_required for a proven logic error or mandatory unchecked return on a real path; remediation_recommended when the failure path is real but consequence is contained.
category: Correctness.
evidence: the traced path, caller, condition values, and the line where behavior diverges from intent.

What NOT to flag

Errors impossible in the call path found (e.g. guarded by IS_ENABLED upstream). Prove reachability before reporting.
Defensive bounds checks without a proven untrusted source.
likely()/unlikely() hint changes with no logic impact.

References (load only when needed)

references/technical-patterns.md, core kernel tracing rules, context rules, error-handling notes, RCU mandatory check.
references/callstack.md, blocking/waiting bug analysis protocol.

Sourcing

Stage text adapted from Sashiko (Apache-2.0). References reproduced from masoncl/review-prompts (MIT).

---name: kernel-execution-flowdescription: Use when a Linux kernel PR diff changes C/Rust control flow, traces execution statically (Sashiko stage 3): broken error paths, NULL derefs, uninitialized or stale values, off-by-one loop logic, preprocessor/linkage hazards in the CHANGED code only. Part of the linux-kernel-review suite.license: Apache-2.0---# kernel-execution-flowLens for control-flow and logic verification (Sashiko stage 3). Acts as astatic analysis engine tracing C (or Rust) execution flow through the diff.## How to apply- Trace every branch, switch, loop, and goto in the changed code.- Explore every error handling path (goto cleanup;) and prove it behaves correctly under failure.- Never make assumptions from return types, comments, WARN_ON/BUG_ON, or error-handling patterns, verify by tracing concrete execution paths. Full tracing discipline: references/technical-patterns.md.- For deadlock/infinite-wait/crash candidates, prove the path is structurally possible, not that it fires every run. Method: references/callstack.md.## Rule index- F1. Logic errors: incorrect loop conditions, inverted tests, off-by-one in bounds, wrong operator precedence.- F2. Unhandled error paths and missing return-value checks. Checking returns of allocation, init, locking, and resource-management calls is a mandatory kernel API contract, not defensive programming. Exceptions: __init/early-boot code, debugfs APIs, teardown paths, explicit (void) casts with sound justification.- F3. NULL pointer dereference. Reading a pointer field is not a dereference; only accessing its contents is. Prove the NULL can reach the access.- F4. Preprocessor and linkage correctness: CONFIG_ prefix misspellings (e.g. HAVE_ where CONFIG_ was intended), #ifdef branch divergence, static/inline or section placement that breaks linking or loses symbols under LTO.## Mapping a finding to the contract- action_level: action_required for a proven logic error or mandatory unchecked return on a real path; remediation_recommended when the failure path is real but consequence is contained.- category: Correctness.- evidence: the traced path, caller, condition values, and the line where behavior diverges from intent.## What NOT to flag- Errors impossible in the call path found (e.g. guarded by IS_ENABLED upstream). Prove reachability before reporting.- Defensive bounds checks without a proven untrusted source.- likely()/unlikely() hint changes with no logic impact.## References (load only when needed)- references/technical-patterns.md, core kernel tracing rules, context rules, error-handling notes, RCU mandatory check.- references/callstack.md, blocking/waiting bug analysis protocol.## SourcingStage text adapted from Sashiko (Apache-2.0). References reproduced frommasoncl/review-prompts (MIT).

Frequently asked questions