exploit-verifier

What problem does it solve?

Penetration testers and red teamers often waste significant time validating reported vulnerability findings, many of which turn out to be false positives. This Skill eliminates that inefficiency by providing a systematic, repeatable process to verify exploit validity, produce evidence-backed reports, and prioritize real security risks.

Core Features & Use Cases

• Triple-Check Verification Method: A structured three-phase workflow (Static Viability, Dynamic Trigger, Sink Confirmation) that ensures no verification step is skipped, reducing human error and inconsistent results.
• Multi-Domain Support: Includes specialized checklists and templates for web application, API, and AI/LLM pentesting, covering common vulnerability classes like XSS, SQLi, BOLA/IDOR, and prompt injection.
• Standardized Reporting: Generates formal verification reports with clear Confirmed/Partial/False Positive verdicts, confidence scores, and remediation guidance, ready for client delivery or bug bounty submissions.
• Use Case: A pentester receives a reported SQL injection finding from an automated scanner. Using this Skill, they run the three-phase check, confirm the vulnerability is valid with extracted database evidence, and submit a professional verification report to the client.

Quick Start

Use the exploit-verifier skill to validate the reported reflected XSS finding on the /search endpoint of the target web application and generate a formal verification report.