mcpbeat Sign in

Nday Agent Skill

by Encod3d-Sec

N-day / patch-diff workflow - given a CVE/advisory or a suspicious patch, diff pre- vs post-patch to locate the fixed bug, build a PoC for the unpatched version, and run variant analysis for a fresh bug. Triggers - "n-day", "patch diff", "diff the patch", "bindiff".

440 tokens
context cost
the whole folder, loaded on every use
1
files
instructions only
0
copies elsewhere
how many repositories repackaged it
320
stars on the repo
on the repository, not the skill itself

Install

one command, takes just this skill from the repository 
npx skills add https://github.com/Encod3d-Sec/TORCH --skill nday

The instruction itself

4 sections, as written by the author

N-day / Patch Diffing

Turn a patched vulnerability into a working PoC, or surface a silently-patched bug. Read [[nday-patch-diffing]] first.

Procedure

  • Acquire both versions - vulnerable + fixed: git tags, release assets, distro packages, or vendor binaries.
  • Diff:
  • source: git log <fixtag>~5..<fixtag> then git diff <vulntag> <fixtag> over the suspect path; read the changed function.
  • binary: BinDiff / Diaphora / [[ghidra]] Version Tracking; open functions flagged changed (not just recompiled).
  • Root-cause from the diff - what the patch *adds* (bounds/auth/sanitization check) reveals what was missing; trace the now-checked value back to attacker input.
  • Build the trigger - craft input that reaches the pre-patch unchecked path; reproduce on the vulnerable build; confirm reachability in a realistic config.
  • Variant analysis - grep / [[codeql]] for the same flawed pattern the patch did not touch -> potential new CVE (then hand off to the disclosure skill).

Output

  • PoC/trigger in raw/research/<project>/poc/ and the bug recorded in findings.md (mark n-day CVE-xxxx or candidate if a new variant).
  • Note affected/fixed versions and the exact patch commit.

Wiki feedback

Reusable diffing trick or a found variant pattern -> update [[nday-patch-diffing]] (or the matching technique page via research-ingest).

Report: target patch, located bug, PoC status, any variant found.

How to use it

Copy the folder

Take encod3d-sec/nday from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.