agentsclimarketplace

Validate vulnerability

Skill gaelic-ghost/socket/plugins/cybersecurity-skills/skills/validate-vulnerability

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill validate-vulnerability

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Determine whether a specific vulnerability claim is valid, reachable, exploitable, and impactful in an authorized environment. Use for scanner candidates, advisories, CVEs, supplied PoCs, source-level concerns, configuration weaknesses, or regression tests when the smallest safe proof, negative controls, exact build, prerequisites, boundary crossed, and confidence must be recorded.

SKILL.md

2.1 KB, 336 tokens by cl100k_base, as published. Nobody here has run it

Validate Vulnerability

Overview

Prove or refute the narrow claim with the least invasive reproduction. Separate vulnerable code or package presence from reachability, controllability, boundary crossing, and demonstrated impact.

Read references/validation-evidence.md for proof levels and controls.

Workflow

  1. Confirm authorization and exact target/build/configuration.
  2. State the hypothesis.
    • Define attacker position, controlled input, preconditions, code/endpoint, expected security property, and observable violation.
  3. Establish controls.
    • Prepare a known-vulnerable or claimed build, fixed/patched or negative build, baseline input, and minimally changed trigger when practical.
  4. Trace reachability.
    • Show how input reaches the affected component and whether authentication, feature flags, deployment topology, sanitization, mitigations, or dead code block it.
    • Use Codex Security for repository attack-path analysis when appropriate.
  5. Reproduce minimally.
    • Prefer harmless markers, bounded data, synthetic accounts, and local fixtures.
    • Stop before destructive impact, persistence, unrelated data access, lateral movement, or instability beyond scope.
  6. Capture evidence.
    • Record request/input, response/output, traces/logs, process or state change, exact tool/version, timestamps, cleanup, and retest.
  7. Classify.
    • Validated exploitable, validated but constrained, vulnerable component present but not reachable, false positive for this target, fixed, or unresolved.

Output

Return hypothesis, environment, controls, reachability, minimal proof, impact boundary, classification/confidence, cleanup, and remediation/retest criteria.

What ships with it: 2 files

923 B alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.