A skill your agent uses when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver.
$ npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install microsoft/win-dev-skills windbg-kernel-bugcheck-triage --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/microsoft/win-dev-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/windbg/skills/windbg-kernel-bugcheck-triage .claude/skills/windbg-kernel-bugcheck-triage && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "windbg-kernel-bugcheck-triage" agent skill from https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triage into .claude/skills/windbg-kernel-bugcheck-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windbg-kernel-bugcheck-triage", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triageType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install microsoft/win-dev-skills windbg-kernel-bugcheck-triage --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/win-dev-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/windbg/skills/windbg-kernel-bugcheck-triage .agents/skills/windbg-kernel-bugcheck-triage && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "windbg-kernel-bugcheck-triage" agent skill from https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triage into .agents/skills/windbg-kernel-bugcheck-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windbg-kernel-bugcheck-triage", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install microsoft/win-dev-skills windbg-kernel-bugcheck-triage --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/win-dev-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/windbg/skills/windbg-kernel-bugcheck-triage .cursor/skills/windbg-kernel-bugcheck-triage && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "windbg-kernel-bugcheck-triage" agent skill from https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triage into .cursor/skills/windbg-kernel-bugcheck-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windbg-kernel-bugcheck-triage", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/microsoft/win-dev-skills.git --path plugins/windbg/skills/windbg-kernel-bugcheck-triage--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install microsoft/win-dev-skills windbg-kernel-bugcheck-triage --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/win-dev-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/windbg/skills/windbg-kernel-bugcheck-triage .gemini/skills/windbg-kernel-bugcheck-triage && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "windbg-kernel-bugcheck-triage" agent skill from https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triage into .gemini/skills/windbg-kernel-bugcheck-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windbg-kernel-bugcheck-triage", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install microsoft/win-dev-skills windbg-kernel-bugcheck-triageInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/microsoft/win-dev-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/windbg/skills/windbg-kernel-bugcheck-triage .github/skills/windbg-kernel-bugcheck-triage && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "windbg-kernel-bugcheck-triage" agent skill from https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triage into .github/skills/windbg-kernel-bugcheck-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windbg-kernel-bugcheck-triage", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install microsoft/win-dev-skills windbg-kernel-bugcheck-triage --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/win-dev-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/windbg/skills/windbg-kernel-bugcheck-triage .opencode/skills/windbg-kernel-bugcheck-triage && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "windbg-kernel-bugcheck-triage" agent skill from https://github.com/microsoft/win-dev-skills/tree/main/plugins/windbg/skills/windbg-kernel-bugcheck-triage into .opencode/skills/windbg-kernel-bugcheck-triage/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windbg-kernel-bugcheck-triage", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
windbg-kernel-bugcheck-triageA skill your agent uses when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver.
Windbg Kernel Bugcheck Triage is an agent skill from microsoft/win-dev-skills, published by the product's own GitHub organization. Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for user-mode process crashes or blaming a module from its name alone.
Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
The repository describes itself as: Agent plugins for building Windows apps with GitHub Copilot, Claude Code, OpenAI Codex, and more. The licence is MIT.
4 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 5ce74fa. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Links to these hosts (documentation or services it may open):
learn.microsoft.comgithub.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Windbg Kernel Bugcheck Triage loads about 1.3k tokens when it runs. Until then it costs about 61 tokens; SKILL.md has 528 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from microsoft/win-dev-skills at commit 5ce74fa, republished under its MIT licence (© microsoft). 528 words, ~1,317 tokens.
.claude/skills/windbg-kernel-bugcheck-triage/SKILL.md (or your agent's skills folder).Load windbg-diagnostic-method first if it is not already loaded in this
conversation, and apply it throughout for evidence ranking, hypothesis testing,
confidence calibration, independent review, and report validation. This skill
adds the bug-family-specific commands and evidence requirements.
Use a kernel crash dump or authorized live kernel session. A process dump captured after a reboot does not contain the earlier kernel fault. Confirm the dump type with the debugger, not a filename or the user's visible symptom. This skill includes exception-context and trap-frame recovery.
.symfix
.sympath+ <your-vendor-symbol-directory>
.reload
!analyze -v
.bugcheck
kReplace the placeholder with the approved symbol location for your own binaries. Record dump type, target architecture/build, bugcheck code and parameters, faulting instruction, and available memory. Public Windows symbols suffice for many investigations; do not require private Windows source or PDBs.
| Code | Parameter meaning / next step |
|---|---|
0x1E | P1 exception code; P2 exception address; P3/P4 exception-specific information. These are not generically a CONTEXT pair. |
0x7E | P1 exception code; P2 exception address; P3 EXCEPTION_RECORD; P4 CONTEXT. |
0x3B | P1 exception code; P2 instruction address; P3 CONTEXT; P4 unused. |
0x0A / 0xD1 | Referenced address, IRQL, access information, instruction address. Decode the access field for that code; these parameters are not generally a trap-frame pointer. |
0x50 | Invalid memory reference; parameter interpretation varies with target version. Consult the code reference. |
0x9F | P1 selects the power-failure subtype; use its specific parameter table and windbg-kernel-irp-lifecycle-triage where applicable. |
| Verifier-class stop | Use windbg-kernel-verifier-triage and the exact code/subcode definition. |
Do not reuse a parameter layout across different bugchecks.
For 0x7E:
.exr <P3>
.cxr <P4>
kb
rFor 0x3B:
.cxr <P3>
kb
rFor other exception-style bugchecks, locate a valid saved exception/context
using the documented code procedure and available analysis output. Do not
guess .cxr arguments from arbitrary P1..P4 values.
When !analyze -v or verified stack evidence identifies a TRAP_FRAME:
.trap <trap-frame-address>
kb
rTrap frames can be partial: some registers may be missing or reconstructed incorrectly. Note the debugger's warnings and do not treat unsaved registers as reliable evidence. If a frame is missing, malformed, or absent from the dump, report the limitation rather than scanning arbitrary pointers and claiming a recovered context.
!thread
lmvm <driver-module>
.frame /r <frame-number>Inspect the recovered instruction, register/object used, IRQL, ownership,
and nearby driver frames. A crash in an operating-system routine may result
from prior driver corruption. Conversely, a third-party name in
MODULE_NAME does not establish that the named driver caused the failure.
Verify vendor build identity against the matching binary/PDB.
For concurrency or blocked requests use windbg-kernel-lock-deadlock-triage or
windbg-kernel-irp-lifecycle-triage. Kernel ~ commands select processors, not the
application thread list; use documented thread/process inspection such as
!thread and !process 0 7.
Record the decoded parameters, recovered context and its limitations, and the
evidence connecting the driver's operation to the violated invariant. Test
competing lifetime, bounds, IRQL, and synchronization explanations. Recommend
an instrumented test/repro only with approval; route Verifier evidence to
windbg-kernel-verifier-triage. Do not call a guessed module assignment a proven cause.
Follow FEEDBACK.md and submit only reviewed, sanitized feedback to
WinDbg-Feedback.
Include windbg-kernel-bugcheck-triage and the package version from plugin.json; no
automatic kernel dump, private-symbol, or source upload.
© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in plugins/windbg/skills/windbg-kernel-bugcheck-triage of microsoft/win-dev-skills.
Open the folder on GitHubat commit 5ce74fa
Windbg Kernel Bugcheck Triage next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Windbg Kernel Bugcheck Triage this skillmicrosoft/win-dev-skills | 462 | — | ~1.3k | Automated safety check: Pass | MIT | |
| Triaging Windows With Kapemukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.3k | Automated safety check: Pass | Apache-2.0 | |
| Windows Kernel Securitygmh5225/awesome-game-security | 3.6k | — | ~317 | Automated safety check: Pass | MIT | |
| Triaging Issuespytorch/pytorch | 104k | — | ~4.2k | Automated safety check: Pass | Custom licence | |
| Issue Triagepaperclipai/paperclip | 99k | — | ~1k | Automated safety check: Pass | MIT | |
| Triagepnpm/pnpm | 37k | — | ~2.9k | Automated safety check: Pass | MIT |
mukul975/Anthropic-Cybersecurity-Skills
Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping…
gmh5225/awesome-game-security
Analyze Windows driver trust, callbacks, IRQL, kernel memory, DSE, PatchGuard, VBS/HVCI, ETW, crash evidence, and build-specific internals for authorized game-security research.
pytorch/pytorch
Triages GitHub issues by routing to oncall teams, applying labels, and closing questions.
paperclipai/paperclip
Triage Paperclip inbox issues that are stale, blocked, in-review, or assigned-but-not-progressing, and decide a single next action per issue (resume, reassign, unblock, escalate, or close).
pnpm/pnpm
Triage an incoming GitHub issue against the pnpm codebase and related open issues, then apply exactly one implementation-readiness label using pnpm's state: taxonomy.
herdrdev/herdr
Triages open herdr GitHub issues into a short decision-first Markdown table with a priority light, recommendation, age, reactions and a reason for each.
microsoft/win-dev-skills
Use with every WinDbg plugin investigation to apply evidence-first reasoning, confidence calibration, contrarian review, structured reporting, and deterministic validation.
microsoft/win-dev-skills
A skill your agent uses when kernel evidence shows stalled I/O, a power IRP, or completion/cancellation misuse; inspect request state and driver ownership.
microsoft/win-dev-skills
A skill your agent uses when kernel threads block on driver synchronization or Verifier reports a lock-order violation; build an owner/waiter graph.
microsoft/win-dev-skills
A skill your agent uses when a kernel dump contains Driver Verifier violations; inspect flags, bugcheck subcodes, and available I/O shadow state.
microsoft/win-dev-skills
A skill your agent uses when a native C/C++ app, service, or user-mode driver host (including UMDF) crashes with a structured exception in a dump or WinDbg session, including native faults inside…
microsoft/win-dev-skills
A skill your agent uses when an app, service, or user-mode driver host heap fails or Application Verifier detects corruption; inspect history and bounds.
A skill your agent uses when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Windbg Kernel Bugcheck Triage is an agent skill from microsoft/win-dev-skills, published by the product's own GitHub organization. Use when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver.
Windbg Kernel Bugcheck Triage fits situations like: A kernel dump reports a Windows bugcheck; decode parameters and recover exception; trap context before investigating your driver.
Run `npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a claude-code`. Or copy the skill folder (plugins/windbg/skills/windbg-kernel-bugcheck-triage in microsoft/win-dev-skills) into .claude/skills/windbg-kernel-bugcheck-triage in your project. Claude Code loads it when a task matches its description.
Run `npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a codex`. Or copy the skill folder (plugins/windbg/skills/windbg-kernel-bugcheck-triage in microsoft/win-dev-skills) into .agents/skills/windbg-kernel-bugcheck-triage in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/win-dev-skills --skill windbg-kernel-bugcheck-triage -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/windbg-kernel-bugcheck-triage, .gemini/skills/windbg-kernel-bugcheck-triage, .github/skills/windbg-kernel-bugcheck-triage and .opencode/skills/windbg-kernel-bugcheck-triage in your project.
SKILL.md names no scripts, command-line tools or credentials: Windbg Kernel Bugcheck Triage is instructions for the agent only.
SKILL.md names 2 domains. As links in the text: learn.microsoft.com and github.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Windbg Kernel Bugcheck Triage is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.3k tokens (SKILL.md is roughly 5.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Windbg Kernel Bugcheck Triage: Triaging Windows With Kape (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Windows Kernel Security (gmh5225/awesome-game-security, 3.6k stars), Triaging Issues (pytorch/pytorch, 104k stars) and Issue Triage (paperclipai/paperclip, 99k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
microsoft (a GitHub organization, an official publisher) maintains it in microsoft/win-dev-skills, which has 462 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on October 7, 2026.
Source: microsoft/win-dev-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
