vulnerability-validation

Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable. Use when this capability is needed.

Ir a la instalación

Repositorio: tomevault-io/skills-registry
Última actividad en el origen: 3 de julio de 2026 a las 19:45
Idioma detectado de SKILL.md: inglés
Estrellas: 0
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/tomevault-io/skills-registry --skill vulnerability-validation

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

2 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

Vulnerability Validation

This is a bundled local Bug Hunter companion skill. It strengthens the security-specific parts of the Skeptic/Referee process.

Purpose

Take suspected or confirmed security findings and answer:

Is the vulnerable path reachable?

Can an attacker control the input?

Are there existing mitigations?

How exploitable is it really?

What is the CVSS / PoC / impact level?

Inputs

Prefer Bug Hunter-native artifacts:

.bug-hunter/findings.json

.bug-hunter/threat-model.md

.bug-hunter/security-config.json

.bug-hunter/dep-findings.json when dependency issues are involved

Workflow

Read the findings and isolate the security ones.

Trace reachability:

EXTERNAL
AUTHENTICATED
INTERNAL
UNREACHABLE

Trace exploitability:

EASY
MEDIUM
HARD
NOT_EXPLOITABLE

Check for mitigations already present in code, framework behavior, or deployment assumptions.

For confirmed HIGH/CRITICAL security bugs, generate:

exploitation path
benign proof of concept
CVSS vector + score

Feed the result back into Bug Hunter-native verdicting.

Outputs

When used as a companion to the main pipeline, keep outputs compatible with:

.bug-hunter/referee.json

.bug-hunter/report.md

If a separate validation artifact is helpful for the run, place it under .bug-hunter/validated-findings.json.

Important constraints

This skill validates findings; it does not replace the normal fix pipeline.

Keep outputs portable and self-contained under .bug-hunter/.

Prefer explicit reasoning for false positives so the user can trust dismissals.

name	vulnerability-validation
description	Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable. Use when this capability is needed.
metadata	{"author":"codexstar69"}