bug-reproduce-test

bug-reproduce-test is a skill for Claude Code from pronskiy/php-src-developer. It costs 111 tokens per session (2,476 once invoked), scanned A, original, MIT.

A workflow step for turning a reported PHP source-code bug into a minimal failing .phpt test. A .phpt file is PHP's test format, and TDD means using tests to capture expected behavior before fixing code.

In plain words
What is it for?
Use it when a bug specification is ready and you need a standalone reproduction script plus a test that currently fails against a built PHP command-line binary.
Why use it?
It proves that the reported problem can be reproduced and preserves that reproduction as a regression test.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: mentions CLAUDE.md.

Part of the php-core-developer plugin — 9 skills, 1 agent shipped together

Good fit Use it when a bug specification is ready and you need a standalone reproduction script plus a test that currently fails against a built PHP command-line binary.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/pronskiy/php-src-developer/bug-reproduce-test
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add pronskiy/php-src-developer --skill bug-reproduce-test
Clone the repo
git clone --depth 1 https://github.com/pronskiy/php-src-developer

Made for: Claude Code.

Or install php-core-developer, the plugin that ships this one along with the rest of its 9 skills, 1 agent.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bug-reproduce-test

README.md
[![agentmods](https://agentmods.dev/badge/skills/pronskiy/php-src-developer/bug-reproduce-test/github.svg)](https://agentmods.dev/skills/pronskiy/php-src-developer/bug-reproduce-test)
Your own site
<a href="https://agentmods.dev/skills/pronskiy/php-src-developer/bug-reproduce-test"><img src="https://agentmods.dev/badge/skills/pronskiy/php-src-developer/bug-reproduce-test/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for bug-reproduce-test

Your own site · 80×15
<a href="https://agentmods.dev/skills/pronskiy/php-src-developer/bug-reproduce-test"><img src="https://agentmods.dev/badge/skills/pronskiy/php-src-developer/bug-reproduce-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 111 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,476 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00111 $0.02476
Opus 5.5 $0.00044 $0.00990
Sonnet 5.5 $0.00022 $0.00495
Haiku 4.5 $0.00011 $0.00248

Measured 1mo ago against content hash 819e62d53aa8, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bug-reproduce-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/php-core-developer/skills/bug-reproduce-test/SKILL.md · 190 lines

How it starts

The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.

bug-reproduce-test

Second step of the bug-fix flow. Reads the Context already in SPEC.md, builds a minimal PHP reproduction, converts it into a .phpt test under $PHP_SRC_DIR, runs it, and asserts it FAILS (TDD).

Inputs

  1. SPEC.md in the task directory resolved per _shared/task-dir.md (env var → .current → cwd) with type: bug and Context phase done. Refuse otherwise.
  2. $PHP_SRC_DIR with a built sapi/cli/php.

What it produces

  • repro.php — minimal standalone reproduction script in the task directory, for the user's eyeballing
  • $PHP_SRC_DIR/<tests-path>/ghNNNNN.phpt — the new test, following the conventions of the surrounding directory
  • Updated SPEC.md: Reproduction phase populated, status → done once post-guardrail is green

Phase owned

Reproduction.

Steps this skill adds:

  • repro-script — minimal repro.php reproduces the issue against $PHP_SRC_DIR/sapi/cli/php. Notes observed vs expected.
  • phpt-failing — .phpt test created at the appropriate path; run-tests.php returns failure.

Workflow

1. Pre-guardrails

  • SPEC.md exists and has type: bug. If type: idea, refuse with: idea SPECs don't use bug-reproduce-test.
  • Context phase is done. If not, refuse with: Run /bug-context first.
  • Research phase soft-check: if a Research phase exists with status todo, print one warning line and proceed:
    ⚠ Research phase still todo. Run /research first for prior-art (or mark it `skipped` in SPEC.md to silence this warning).
    
    done, skipped, or blocked → no warning. Status done → read Research findings; they may already pin a subsystem or hint at a prior test that captures the bug.
  • Reproduction phase is todo or in-progress. If done, refuse with: Reproduction phase is already done. Run /bug-fix next. If blocked, refuse with: Reproduction is blocked: <reason>. Resolve before retrying.
  • $PHP_SRC_DIR/sapi/cli/php exists. If missing, do not auto-build — output the build commands and stop:
    $PHP_SRC_DIR/sapi/cli/php missing. Build it first:
      cd "$PHP_SRC_DIR"
      ./buildconf
      ./configure --enable-debug
      make -j$(nproc)
    
  • target_branch matches the checked-out branch. Read target_branch from SPEC.md frontmatter. If set (not null) and not equal to git -C "$PHP_SRC_DIR" rev-parse --abbrev-ref HEAD, refuse with:
    SPEC.md target_branch is <X>; $PHP_SRC_DIR is on <Y>.
    Switch with:
      git -C "$PHP_SRC_DIR" checkout <X>
      cd "$PHP_SRC_DIR" && make -j$(nproc)
    …or update target_branch in SPEC.md if the resolution was wrong.
    
    Do not auto-switch branches (CLAUDE.md: "Executing actions with care" — branch swaps trigger rebuilds the user may not want unprompted).
  • If target_branch: null (resolver couldn't decide), refuse with: target_branch is null in SPEC.md. Resolve the Open Question raised by /bug-context before reproducing.

Read the full file on GitHub · 190 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 190 lines · 111 tokens per session scan A 819e62d53aa8

Subscribe to this mod's changes

bug-reproduce-test is a skill published in the GitHub repository pronskiy/php-src-developer (8 stars, last pushed 4mo ago), licensed MIT. It adds 111 tokens to every session and 2,476 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.