skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

exploit-verifier

Validate penetration testing findings through a three-phase verification process.

11|1|Updated May 4, 2026
Search Tags:#penetration testing#web application security#security reporting#vulnerability validation#false positive reduction#exploit verification#AI red teaming
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill exploit-verifier
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploit-verifier
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/exploit-verifier
Command: npx skills add https://github.com/dreadnode/capabilities --skill exploit-verifier

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Penetration testers and red teamers often waste significant time validating reported vulnerability findings, many of which turn out to be false positives. This Skill eliminates that inefficiency by providing a systematic, repeatable process to verify exploit validity, produce evidence-backed reports, and prioritize real security risks.

Core Features & Use Cases

  • Triple-Check Verification Method: A structured three-phase workflow (Static Viability, Dynamic Trigger, Sink Confirmation) that ensures no verification step is skipped, reducing human error and inconsistent results.
  • Multi-Domain Support: Includes specialized checklists and templates for web application, API, and AI/LLM pentesting, covering common vulnerability classes like XSS, SQLi, BOLA/IDOR, and prompt injection.
  • Standardized Reporting: Generates formal verification reports with clear Confirmed/Partial/False Positive verdicts, confidence scores, and remediation guidance, ready for client delivery or bug bounty submissions.
  • Use Case: A pentester receives a reported SQL injection finding from an automated scanner. Using this Skill, they run the three-phase check, confirm the vulnerability is valid with extracted database evidence, and submit a professional verification report to the client.

Quick Start

Use the exploit-verifier skill to validate the reported reflected XSS finding on the /search endpoint of the target web application and generate a formal verification report.

Frequently Asked Questions about exploit-verifier

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reduce false positives in penetration testing findings?▼

To reduce false positives in penetration testing findings, you can validate reported vulnerabilities using a systematic three-phase verification process that checks static viability, triggers the exploit dynamically, and confirms the sink, producing evidence-backed reports with clear verdicts.

What is the best way to verify reported API vulnerabilities like BOLA and IDOR?▼

The best way to verify reported API vulnerabilities like BOLA and IDOR is to apply a structured three-phase verification workflow that uses specialized checklists to confirm the exploit dynamically and document the evidence for standardized reporting.

How do I validate prompt injection attacks in AI red teaming?▼

To validate prompt injection attacks in AI red teaming, you run the reported finding through a multi-domain verification process designed for AI/LLM systems that dynamically triggers the exploit and produces a confidence-scored verification report.

Can I generate formal client reports for confirmed XSS and SQLi vulnerabilities?▼

Yes, you can generate formal client reports for confirmed XSS and SQLi vulnerabilities by running the finding through a verification workflow that outputs structured reports with Confirmed or False Positive verdicts, confidence scores, and remediation guidance.

Does exploit verification work for web applications, APIs, and LLM systems?▼

Exploit verification works across web applications, APIs, and LLM systems by applying specialized checklists and a standardized three-phase validation workflow to confirm true vulnerabilities across these distinct domains.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

recon-sector-expansion

Discover and validate company domains using certificate transparency logs and automated probing.

Community
Advanced
rocklambrosrocklambros
2

writing-pentest-finding

Generate client-deliverable penetration-test findings with CVSS v3.1 vectors and remediation.

Community
Advanced
dapperdiversdapperdivers
1

vuln-scan

Scan web applications for vulnerabilities using nuclei and nikto.

Community
Advanced
jassicsjassics
6

vulnerability-scan-triage

Normalize and deduplicate vulnerability scan findings from multiple scanners.

Community
Intermediate