domains / families / security / security-repro

security-repro

separate

Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.

When to use

• reproduce this CVE
• build a repro for
• demonstrate the EchoLeak/Cursor/postmark-mcp issue
• show how this exploit worked
• add a reproducibility guide
• pull the NVD/CVE details for
• reproduce, demonstrate, or write up a known vulnerability
• reproduce a security incident

When not to use

• discover new zero-days
• develop new exploitation
• weaponize a payload
• reproduce an unpatched bug
• target real infrastructure
• evade detection
• fuzzing for new bugs
• chaining or variant discovery

Skill page

Source