What problem does it solve? Security researchers often mistake weak signals like HTTP 200 responses or callback requests for proven vulnerabilities, leading to rejected bug-bounty reports and wasted effort. This Skill enforces a rigorous readiness gate that promotes a candidate finding to a proven vulnerability only when a separately-verified authoritative outcome crosses a security boundary under attacker control. ## Core Features & Use Cases - Dynamic PoC Readiness Gate: Executes a 10-step validation procedure covering scope confirmation, two-principal separation, attacker control, runtime triggering, independent outcome capture, negative controls, and clean-state reproduction. - Manifest Qualification Output: Maps gate verdicts (pass, conditional pass, fail, parked) to structured manifest fields including record_kind, research_state, closure reasons, and a seven-field qualification block. - Stop Conditions & Anti-Patterns: Applies a negative-control taxonomy to reject theoretical, self-test, or below-threshold findings before they reach a report. - Use Case: After a hunter skill flags a potential IDOR on an API endpoint, run this gate to prove with two separate tenant accounts that the attacker's token actually reads the victim's private object, verified through an independent fetch as the victim, before writing the report. ## Quick Start Ask the agent to validate the candidate finding from the hunter output by running the dynamic PoC readiness gate and updating the findings manifest with the qualification result.
