skills.rest
manuelbrandner85
manuelbrandner85COMMUNITY
Explore all skills by this author →
GitHub

fp-check

Validate suspected security vulnerabilities through data flow analysis and gate reviews.

Updated Nov 23, 2025
Search Tags:#security#vulnerability#verification#data-flow#code-audit#false-positive
One-click install
npx skills add https://github.com/manuelbrandner85/Weltenbibliothekapp --skill fp-check-manuelbrandner85
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fp-check
Source: https://github.com/manuelbrandner85/Weltenbibliothekapp/tree/main/.agents/skills/fp-check
Command: npx skills add https://github.com/manuelbrandner85/Weltenbibliothekapp --skill fp-check-manuelbrandner85

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill addresses the high rate of false positives in automated security scanning by providing a rigorous, evidence-based verification framework that distinguishes between actual vulnerabilities and benign code patterns.

Core Features & Use Cases

  • Standard vs. Deep Verification: Automatically routes bugs based on complexity, ensuring straightforward issues are resolved quickly while complex, cross-component bugs receive deep analysis.
  • Evidence-Based Verdicts: Enforces a strict gate-review process that requires documented data flow analysis, mathematical bounds proofs, and adversarial devil's advocate reviews.
  • Use Case: When a security scanner flags a potential buffer overflow in a legacy C module, use this skill to trace the data flow from source to sink and determine if existing validation logic makes the vulnerability mathematically impossible.

Quick Start

Use the fp-check skill to verify the suspected security bug in the authentication module and provide a final verdict.

Frequently Asked Questions about fp-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify security vulnerabilities to eliminate false positives in code audits?▼

You can verify security vulnerabilities by applying structured data flow analysis to trace paths from source to sink, documenting mathematical bounds proofs and performing adversarial devil's advocate reviews to rigorously distinguish true positives from false positives.

What is the best way to validate suspected security bugs during code review?▼

The best way to validate suspected security bugs is an evidence-based framework that routes straightforward issues to standard verification and complex cross-component bugs to deep analysis, requiring documented data flow analysis before issuing a final verdict.

When do I need data flow analysis to confirm a vulnerability is exploitable?▼

You need data flow analysis to confirm exploitability when automated security scanning flags potential issues like buffer overflows in legacy modules, requiring you to determine if existing validation logic makes the vulnerability mathematically impossible.

Can I use structured verification for complex cross-component security bugs?▼

Yes, structured verification supports complex cross-component security bugs through deep analysis routing, which applies rigorous evidence documentation and adversarial devil's advocate reviews to validate exploitability across interconnected modules.

Why does automated security scanning produce false positives that require verification?▼

Automated security scanning produces false positives because it struggles to interpret existing validation logic, necessitating rigorous evidence-based verification with mathematical bounds proofs to confirm whether suspected data flow vulnerabilities are actually exploitable.

Related Skills

Explore More Software Engineering Skills→
El3tar-cmdEl3tar-cmd
18

security_scan

Orchestrate parallel security scanners to produce prioritized vulnerability reports.

Community
Intermediate
ofelixdevofelixdev

fp-check

Verify suspected security bugs and produce TRUE POSITIVE or FALSE POSITIVE verdicts.

Community
Advanced
0xShe0xShe
386

php-cmd-audit

Trace PHP data flows from user input to command execution sinks.

Community
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate