Validate security findings by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running flux-security-scan to confirm vulnerabilities. Triggers on /flux:vuln-validate.
From fluxnpx claudepluginhub nairon-ai/flux --plugin fluxThis skill uses the workspace's default tool permissions.
Dispatches parallel agents to independently tackle 2+ tasks like separate test failures or subsystems without shared state or dependencies.
Executes pre-written implementation plans: critically reviews, follows bite-sized steps exactly, runs verifications, tracks progress with checkpoints, uses git worktrees, stops on blockers.
Guides idea refinement into designs: explores context, asks questions one-by-one, proposes approaches, presents sections for approval, writes/review specs before coding.
Validate security findings by assessing whether they are actually exploitable in the context of this codebase. This skill filters false positives, confirms real vulnerabilities, and generates proof-of-concept exploits.
Adapted from Factory AI security-engineer plugin.
On entry, set the session phase:
PLUGIN_ROOT="${DROID_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}}"
[ ! -d "$PLUGIN_ROOT/scripts" ] && PLUGIN_ROOT=$(ls -td ~/.claude/plugins/cache/nairon-flux/flux/*/ 2>/dev/null | head -1)
FLUXCTL="${PLUGIN_ROOT}/scripts/fluxctl"
$FLUXCTL session-phase set vuln_validate
On completion, reset:
$FLUXCTL session-phase set idle
.flux/threat-model.md must exist (from flux-threat-model skill).flux/security/security-findings.json must exist (from flux-security-scan skill)| Input | Description | Required | Default |
|---|---|---|---|
| Findings file | Path to security-findings.json | Yes | .flux/security/security-findings.json |
| Threat model | Path to threat model | No | .flux/threat-model.md |
| Finding IDs | Specific findings to validate (comma-separated) | No | All findings |
| Severity filter | Only validate findings at or above this severity | No | All severities |
Follow these steps for each finding to validate:
.flux/security/security-findings.json from flux-security-scan.flux/threat-model.md for system contextFor each finding, determine if the vulnerable code is reachable:
Trace entry points
Map the call chain
Classify reachability
EXTERNAL - Reachable from unauthenticated external inputAUTHENTICATED - Requires valid user sessionINTERNAL - Only reachable from internal servicesUNREACHABLE - Dead code or blocked by conditionsDetermine if an attacker can control the vulnerable input:
Check if existing security controls prevent exploitation:
| Rating | Criteria |
|---|---|
EASY | No special conditions, standard tools, publicly known technique |
MEDIUM | Requires specific conditions, timing, or chained vulnerabilities |
HARD | Requires insider knowledge, rare conditions, or advanced techniques |
NOT_EXPLOITABLE | Theoretical vulnerability but not practically exploitable |
For confirmed vulnerabilities, create a proof-of-concept:
{
"proof_of_concept": {
"payload": "' OR '1'='1",
"request": "GET /api/users?search=' OR '1'='1",
"expected_behavior": "Returns users matching search term",
"actual_behavior": "Returns all users due to SQL injection"
}
}
Assign a CVSS 3.1 score based on:
| Metric | Options |
|---|---|
| Attack Vector (AV) | Network (N), Adjacent (A), Local (L), Physical (P) |
| Attack Complexity (AC) | Low (L), High (H) |
| Privileges Required (PR) | None (N), Low (L), High (H) |
| User Interaction (UI) | None (N), Required (R) |
| Scope (S) | Unchanged (U), Changed (C) |
| Confidentiality (C) | None (N), Low (L), High (H) |
| Integrity (I) | None (N), Low (L), High (H) |
| Availability (A) | None (N), Low (L), High (H) |
| Status | Meaning |
|---|---|
CONFIRMED | Vulnerability is real and exploitable |
LIKELY | Probably exploitable but couldn't fully verify |
FALSE_POSITIVE | Not actually a vulnerability (document why) |
NEEDS_MANUAL_REVIEW | Requires human security expert review |
Create .flux/security/validated-findings.json:
{
"validation_id": "val-<timestamp>",
"validation_date": "<ISO timestamp>",
"scan_id": "<from security-findings.json>",
"validated_findings": [
{
"id": "VULN-001",
"status": "CONFIRMED",
"validated_severity": "HIGH",
"exploitability": "EASY",
"reachability": "EXTERNAL",
"exploitation_path": ["Step 1", "Step 2", "..."],
"proof_of_concept": {...},
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvss_score": 9.1
}
],
"false_positives": [
{
"id": "VULN-003",
"reason": "Input validated by schema in middleware",
"evidence": "See src/middleware/validation.js:45"
}
],
"summary": {
"total_analyzed": 10,
"confirmed": 5,
"likely": 2,
"false_positives": 2,
"needs_manual_review": 1
}
}