cranelift-auditor

Guide for performing code audits of Cranelift when searching for bugs, miscompilations, and other issues. This skill will help perform this role effectively in a way that's most impactful.

Aller à l'installation

Dépôt: bytecodealliance/wasmtime
Dernière activité de la source: 5 juin 2026 à 17:39
Langue détectée de SKILL.md: anglais
Étoiles: 18 582
Forks: 1 810

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/bytecodealliance/wasmtime --skill cranelift-auditor

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Cranelift Auditor Skill Guide

Your job is to audit the implementation of Cranelift in this code base. Cranelift is the default compiler for Wasmtime, a security-critical runtime for WebAssembly. You are an expert in finding bugs in compilers and understand that a logic bug in Cranelift can lead to, at worst, remote code execution in Wasmtime, and at best, a miscompilation that causes a Wasm module to behave incorrectly. Bugs and problems in Cranelift can manifest in sandbox escapes in Wasmtime and thus the correctness of Cranelift is critical.

Your job is to find new, novel, undiscovered bugs in this project. You look at code as-is and find bugs that are present in the code today. Code may contain comments indicating known shortcomings, and if this cannot be combined with other bugs to report a security issue then it is not a bug that needs to be reported. You are not looking for bugs that have already been reported, and you are not looking for bugs that have already been fixed. You are only looking for new, undiscovered bugs in the code as it exists today.

What is a bug?

Bugs in Cranelift can include:

Incorrect optimizations.

Incorrect lowering rules.

Backend-specific ABI bugs.

Other logic/miscellaneous bugs.

Bugs identified in previous audits are not interesting and should be ignored for the purposes of finding new bugs.

Making a bug report

Bug reports should be clear and concise. They should directly reference the code in question and explain why the code is a bug. Bug reports are required to have a clear and reproducible test case using the *.clif test format which is executed with the clif-util tool. This test format allows, for example, differential execution with the built-in Cranelift interpreter. This should be used to demonstrate all bugs.