From find-cve-agent
Eliminates false positives in security findings using 6-gate verification, 13-item checklist, and devil's advocate questioning before CVE submission.
npx claudepluginhub byamb4/find-cve-agentThis skill uses the workspace's default tool permissions.
Before ANY finding is submitted. No exceptions. This is the final gate.
Verifies suspected security bugs by restating claims, tracing data flows, and checking mitigations to issue TRUE POSITIVE or FALSE POSITIVE verdicts with evidence.
Verifies suspected security bugs systematically to eliminate false positives, producing TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence.
Validates security vulnerability findings by tracing data flows, verifying exploit conditions, analyzing controls, and testing attack vectors on live apps.
Share bugs, ideas, or general feedback.
Before ANY finding is submitted. No exceptions. This is the final gate.
| Rationalization | Why It Is Wrong | Action |
|---|---|---|
| "This pattern looks dangerous" | Pattern recognition is not analysis | Trace actual data flow |
| "Similar code was vulnerable elsewhere" | Each context differs | Verify this specific instance |
| "This is clearly critical" | LLMs are biased toward seeing bugs | Complete devil's advocate |
| "Skipping verification for efficiency" | No partial analysis allowed | Run all gates |
Restate the vulnerability in one precise sentence. If you cannot, it's likely false.
Half of false positives collapse at this step — the claim doesn't make coherent sense.
Standard — clear claim, single component, well-understood bug class, no concurrency. Deep — ambiguous claim, cross-component flow, race conditions, logic bugs, or standard was inconclusive.
Start with Standard. It has built-in escalation checkpoints.
| # | Check | If YES |
|---|---|---|
| 1 | README warns against untrusted input? | Gray area — document it |
| 2 | Documented/intended behavior? | FALSE POSITIVE |
| 3 | Library handles this gracefully? | FALSE POSITIVE |
| 4 | Alpha/beta/pre-release? | Unlikely to get CVE |
| 5 | JSON.parse does the same? | Show REAL crash beyond JSON.parse |
| 6 | OOM crash or caught RangeError? | RangeError = lower severity |
| 7 | Requires admin privileges? | Check if access is genuinely new |
| 8 | Exact version already patched? | DUPLICATE |
| 9 | Framework sanitizes at middleware? | FALSE POSITIVE |
| 10 | Runtime blocks this? | FALSE POSITIVE |
| 11 | >10 prior CVEs on this project? | Over-audited — proceed with caution |
| 12 | Different package with similar name? | Verify exact package |
| 13 | Only works with non-default config? | Severity drops significantly |
VERDICT: TRUE POSITIVE / FALSE POSITIVE / NEEDS MORE INFO
Gates passed: X/6
Checklist flags: [list any concerns]
Devil's advocate: [key doubt and resolution]
Evidence: [concrete proof]
Confidence: HIGH / MEDIUM / LOW