What problem does it solve? Security auditing a large WebAssembly runtime like Wasmtime requires deep domain knowledge, systematic exploration, and reproducible evidence. This Skill guides an AI agent through a disciplined audit of the Wasmtime codebase to find new, undiscovered bugs and vulnerabilities. ## Core Features & Use Cases - Structured Bug Hunting: Defines what counts as a valid bug (issues reachable through the public wasmtime crate API or CLI), prioritizing Tier 1 and Tier 2 features. - Reproducible Test Cases: Requires every finding to include a runnable proof, either as a .wast test file or a Rust crate depending on wasmtime. - Organized Reporting: Produces numbered bug report folders and intermediate findings under a reports/ directory with system info, commit version, and audit date. - Use Case: A security researcher asks the agent to audit Wasmtime's table implementation; the agent explores the code, builds a failing .wast reproduction, and writes reports/001-table-oom/report.md. ## Quick Start Audit the Wasmtime codebase in this repository for new security bugs and write reproducible reports into the reports folder.
