Stats
Actions
Tags
From cybersec-toolkit
Verifies suspected security bugs as true or false positives with documented evidence. Useful when validating a specific vulnerability claim.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:fp-checkThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
- "Is this bug real?" or "is this a true positive?"
If you catch yourself thinking any of these, STOP.
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "Rapid analysis of remaining bugs" | Every bug gets full verification | Return to task list, verify next bug through all phases |
| "This pattern looks dangerous, so it's a vulnerability" | Pattern recognition is not analysis | Complete data flow tracing before any conclusion |
| "Skipping full verification for efficiency" | No partial analysis allowed | Execute all steps per the chosen verification path |
| "The code looks unsafe, reporting without tracing data flow" | Unsafe-looking code may have upstream validation | Trace the complete path from source to sink |
| "Similar code was vulnerable elsewhere" | Each context has different validation, callers, and protections | Verify this specific instance independently |
| "This is clearly critical" | LLMs are biased toward seeing bugs and overrating severity | Complete devil's advocate review; prove it with evidence |
Before any analysis, restate the bug in your own words. If you cannot do this clearly, ask the user for clarification using AskUserQuestion. Half of false positives collapse at this step — the claim doesn't make coherent sense when restated precisely.
Document:
parse_header() when content_length exceeds 4096")memcpy at line 142")After Step 0, choose a verification path.
Use when ALL of these hold:
Follow standard-verification.md. No task creation — work through the linear checklist, documenting findings inline.
Use when ANY of these hold:
Follow deep-verification.md. Create the full task dependency graph and execute phases with the plugin's agents.
Start with standard. Standard verification has two built-in escalation checkpoints that route to deep when complexity exceeds the linear checklist.
When verifying multiple bugs at once:
After processing ALL suspected bugs, provide:
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitVerifies suspected security bugs systematically to eliminate false positives, producing TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence.
Verifies suspected security bugs by restating claims, tracing data flows, and checking mitigations to issue TRUE POSITIVE or FALSE POSITIVE verdicts with evidence.
Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.