Receber por email
← Voltar para o catálogo

verify-finding

Drive a single finding through CPG verification and false-positive triage.

22estrelas
Atualizado há 4 meses

Ver no GitHub ↗ Licença: MIT

Como adicionar

/plugin marketplace add allsmog/vuln-scout

O comando exato pode variar conforme o repositório. Confira o README no GitHub.

Para o autor da skill

Cole no README do seu repo

Mostra que sua skill está catalogada na Skillteca, gera backlink e tráfego rastreável.

[![Skillteca](https://www.skillteca.com.br/api/badge/verify-finding/svg)](https://www.skillteca.com.br/skills/verify-finding)

Skills relacionadas

Ver todas de Desenvolvimento →

Alerta por categoria

Receba novas skills de Desenvolvimento toda segunda

1 email curto, só com as skills novas de Desenvolvimento. 4 minutos de leitura, sem spam, cancela com 1 clique.

Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.

Ler descrição completa

Verify Finding

Use this task skill when the user asks to verify VSCOUT-*, asks whether a finding is exploitable, or asks to confirm a specific finding.

Workflow

  1. Locate the finding by ID, stable key, or file:line in .claude/findings.json.
  2. Run /vuln-scout:trace on the source-to-sink path.
  3. Run /vuln-scout:verify for CPG-backed confirmation.
  4. Call false-positive-verifier when controls, sanitizers, or reachability are unclear.
  5. Call local-tester only when dynamic validation is explicitly safe and useful.
  6. Run /vuln-scout:propagate when a confirmed pattern may repeat.
  7. Update .claude/review-ledger.json with the final verification state.

Produces

  • Updated .claude/review-ledger.json entry
  • optional trace artifact

When NOT To Trigger

Do not trigger for broad scans, PR review, generic exploitability education, dangerous-function lists, or CPG query syntax questions that do not name a finding.

Compartilhar X LinkedIn