# Poc Repro Verify

> Run real proof-of-concept reproduction verification across vulnerable and patched revisions from a GitHub fix commit. Use when the user needs to validate whether a PoC actually reproduces on pre-patch code and is blocked or changed on patched code.

- Skill: `skills-generator/poc-repro-verify` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add skills-generator/poc-repro-verify`
- Raw SKILL.md: https://api.skillmd.com/api/skills/skills-generator/poc-repro-verify/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: skills-generator (https://skillmd.com/u/skills-generator)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/skills-generator/poc-repro-verify

---


# PoC Reproduction Verifier

## Workflow

1. Build or collect commit metadata (`owner`, `repo`, `sha`) from a GitHub commit URL.
2. Prepare a deterministic verification command (`check-cmd`) that returns machine-checkable exit status.
3. Optionally prepare environment setup command (`setup-cmd`) for build/dependency bootstrap.
4. Run `scripts/verify_repro.py` to execute checks on:
- vulnerable revision: `<sha>^`
- patched revision: `<sha>`
5. Review `verification-report.json` and `verification-report.md`.
6. Report final verdict with explicit assumptions and safety boundaries.

## Inputs

Minimum required:
- GitHub commit URL or `meta.json`
- Verification command (`--check-cmd`)

Optional:
- Setup command (`--setup-cmd`)
- PoC script to stage into both revisions (`--poc-script`)
- Repo URL override for forks/mirrors (`--repo-url`)
- Verdict mode (`--verdict-mode`)

## Commands

### 1) Create metadata from commit URL

```bash
python3 scripts/make_meta.py <commit_url> --out ./artifacts/commit-meta.json
```

### 2) Run real verification

```bash
python3 scripts/verify_repro.py \
  --meta ./artifacts/commit-meta.json \
  --check-cmd "<your-check-command>" \
  --verdict-mode different_exit_codes \
  --work-dir ./verify-work
```

### 3) Verify a generated PoC script directly

```bash
python3 scripts/verify_repro.py \
  --meta ./artifacts/commit-meta.json \
  --poc-script ./poc_generated.py \
  --check-cmd "python3 ./poc_generated.py --target localhost --mode check" \
  --verdict-mode vuln_zero_patched_nonzero
```

## Verdict Modes

- `different_exit_codes`: vulnerable and patched exits must differ
- `vuln_nonzero_patched_zero`: vulnerable should fail, patched should pass
- `vuln_zero_patched_nonzero`: vulnerable should pass, patched should fail
- `same_exit_codes`: both should match (control checks)

Pick the mode that reflects the PoC success definition.

## Output Requirements

Always include:
- commit URL and revisions used
- exact commands executed
- vulnerable and patched exit codes
- selected verdict mode and final PASS/FAIL
- key assumptions and known limitations

Use [verification-template.md](references/verification-template.md) as final reporting structure.

## Safety Rules

- Run only in local/disposable and authorized environments.
- Do not target production or unauthorized third-party assets.
- Keep payloads minimal and non-destructive.
- Separate "proof of behavior" from exploit escalation.

## Resource Usage

- Use [make_meta.py](scripts/make_meta.py) when only commit URL is provided.
- Use [verify_repro.py](scripts/verify_repro.py) as the primary execution engine.
- Use [verification-template.md](references/verification-template.md) to normalize output.

## Quality Checklist

Before finalizing:
- `check-cmd` is deterministic and bounded by timeout
- vulnerable and patched revisions are correct
- verdict mode matches expected vulnerability behavior
- report includes both raw command results and interpretation