npx claudepluginhub ghostsecurity/skills --plugin ghostThis skill uses the workspace's default tool permissions.
Determine whether a security finding is a true positive or false positive. Produce a determination with supporting evidence.
Verifies suspected security bugs by restating claims, tracing data flows, and checking mitigations to issue TRUE POSITIVE or FALSE POSITIVE verdicts with evidence.
Verifies suspected security bugs systematically to eliminate false positives, producing TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence.
Eliminates false positives in security findings using 6-gate verification, 13-item checklist, and devil's advocate questioning before CVE submission.
Share bugs, ideas, or general feedback.
Determine whether a security finding is a true positive or false positive. Produce a determination with supporting evidence.
The user provides a finding as a file path or pasted text. If neither is provided, ask for one.
Extract: vulnerability class, specific claim, affected endpoint, code location, and any existing validation evidence.
Identify:
If a live instance of the application is accessible and the vulnerability can be confirmed through live interaction, use the proxy skill to confirm exploitability:
reaper get <id>Classify the finding as one of:
Output a summary in the following format:
Example:
## Validation Result
- **Determination**: True Positive
- **Confidence**: High
- **Evidence**: Handler at routes/transfers.go:142 queries transfers by ID without checking ownership. No middleware or ORM-level constraint enforces user scoping.
- **Recommendation**: Add ownership check — include user_id in the WHERE clause.
If the finding was provided as a file path, ask the user if they would like to append the validation details to the original finding file. If they agree, append a ## Validation section to the file containing the determination, confidence, evidence summary, and recommendation.
See VULNERABILITY_PATTERNS.md in this skill directory for patterns to look for when validating authorization flaws (BFLA/BOLA/IDOR), injection (SQLi/XSS), and authentication flaws.