fp-check

Verify suspected security bugs and classify them as true or false positives.

6.5k|561|Updated Jan 14, 2026

Search Tags:#code review #security auditing #bug analysis #false positive elimination #security bug verification

Ready to run

npx skills add https://github.com/trailofbits/skills --skill fp-check-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: fp-check
Source: https://github.com/trailofbits/skills/tree/main/plugins/fp-check/skills/fp-check
Command: npx skills add https://github.com/trailofbits/skills --skill fp-check-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill systematically verifies suspected security bugs to eliminate false positives, providing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence.

Core Features & Use Cases

Standard and Deep Verification: Offers both straightforward and comprehensive verification methods to suit different complexity levels.
False Positive Patterns Analysis: Identifies and prevents common false positive mistakes in bug analysis.
Bug-Class-Specific Verification: Provides specific guidance for different types of bugs, such as memory corruption, logic bugs, race conditions, etc.
Task-Based Orchestration: Manages the verification process through tasks and dependencies, ensuring all steps are followed.
Pseudocode, Executable, and Unit Test PoCs: Assists in demonstrating the vulnerability through different proof-of-concept methods.

Quick Start

Run the fp-check skill on your code to verify a suspected bug and receive a detailed analysis.

Frequently Asked Questions about fp-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify suspected security bugs to eliminate false positives?▼

Security bug verification systematically analyzes suspected vulnerabilities, execution paths, and exploitability to deliver documented TRUE POSITIVE or FALSE POSITIVE verdicts, eliminating false positives through evidence-based assessment.

How does false positive elimination work for memory corruption and logic bugs?▼

False positive elimination works by applying bug-class-specific analysis for memory corruption, logic bugs, and race conditions, identifying common false positive patterns to systematically verify suspected vulnerabilities.

What is the best way to demonstrate exploitability during security auditing?▼

The best way to demonstrate exploitability during security auditing is by generating pseudocode, executable, and unit test proofs-of-concept to verify the suspected bug and document the evidence.

Can I use standard and deep verification methods for different complexity levels?▼

Yes, you can use both standard and deep verification methods to suit different complexity levels, managing the process through task-based orchestration to ensure all verification steps and dependencies are followed.

When should I not use automated false positive elimination in code review?▼

You should not use automated false positive elimination when detailed analysis of code and execution paths is impossible, as providing a TRUE POSITIVE or FALSE POSITIVE verdict requires comprehensive security auditing and exploitability assessment.