fp-check

Name: fp-check
Availability: InStock
Author: Vigolium

Verify suspected security bugs and issue evidence-backed TRUE POSITIVE or FALSE POSITIVE verdicts.

965|142|Updated Mar 8, 2026

Search Tags:#security auditing #data flow analysis #vulnerability triage #false positive verification #evidence-based security #exploitability validation #guardrail checks

Ready to run

npx skills add https://github.com/vigolium/vigolium --skill fp-check-vigolium

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: fp-check
Source: https://github.com/vigolium/vigolium/tree/main/platform/vigolium-audit/src/content/skills/fp-check
Command: npx skills add https://github.com/vigolium/vigolium --skill fp-check-vigolium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you determine whether a suspected vulnerability is real or a false alarm by requiring systematic evidence-backed verification and a clear TRUE POSITIVE or FALSE POSITIVE verdict.

Core Features & Use Cases

Bug verification gatekeeping: Confirms or rejects a specific vulnerability claim by tracing the exact conditions, path, and threat model.
Standard or deep verification routing: Uses a linear checklist for straightforward cases and escalates to deep, task-based verification for complex or ambiguous claims.
Evidence-first verdicting: Produces documented reasoning and evidence for each bug instead of relying on pattern matching.

Quick Start

Ask the system to verify a specific suspected bug by providing the claim, alleged root cause, trigger, impact, and the relevant code location(s), then request a TRUE POSITIVE or FALSE POSITIVE verdict with evidence.

Frequently Asked Questions about fp-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify a suspected security vulnerability to check if it is a true positive or false positive?▼

False positive verification requires tracing the data flow, trust boundaries, and threat model to produce an evidence-backed verdict. You validate suspected security bugs by restating the claim, following a verification checklist, and documenting the exact trigger conditions and impact.

What is the best way to triage security findings with evidence-based reasoning?▼

Evidence-based security triage involves routing straightforward claims through a linear checklist and escalating complex cases to deep task-based verification. This approach distinguishes true alarms from false ones by requiring documented reasoning instead of relying on pattern matching.

Do I need to provide the root cause and trigger to validate a security bug claim?▼

Yes, validating a specific vulnerability claim requires providing the alleged root cause, trigger, impact, and relevant code locations. Supplying this context allows the verification process to trace data flow accurately and produce a definitive verdict.

When do I need to use deep verification instead of a standard checklist for vulnerability triage?▼

Deep verification is needed when vulnerability claims are complex or ambiguous and cannot be resolved by a linear checklist. Deep task-based verification analyzes intricate data flows and trust boundaries to produce an evidence-backed verdict.

Can I use this approach for general code auditing and bug hunting across a repository?▼

No, this approach applies to targeted validation of specific security findings rather than general code audit or bug hunting. It is designed to verify suspected vulnerabilities by tracing exact conditions and paths to deliver an evidence-first verdict.

Why does pattern matching fail to confirm exploitability for suspected security bugs?▼

Pattern matching fails to confirm exploitability because it lacks guardrail checks and data flow tracing across trust boundaries. Evidence-based security validation requires restating the claim and context to produce a documented verdict rather than relying on automated pattern recognition.