skeptic

Review reported vulnerabilities in code to identify false positives.

479|56|Updated Mar 7, 2026

Search Tags:#code review #security #adversarial testing #bug hunting #vulnerability validation #false positive

Ready to run

npx skills add https://github.com/codexstar69/bug-hunter --skill skeptic-codexstar69

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skeptic
Source: https://github.com/codexstar69/bug-hunter/tree/main/skills/skeptic
Command: npx skills add https://github.com/codexstar69/bug-hunter --skill skeptic-codexstar69

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill acts as an adversarial code reviewer, rigorously challenging reported bugs to eliminate false positives and ensure only genuine vulnerabilities are escalated.

Core Features & Use Cases

Adversarial Review: Critically evaluates bug findings, looking for reasons to disprove them.
False Positive Elimination: Acts as an immune system to prevent wasted developer time on non-issues.
Contextual Analysis: Uses framework knowledge and documentation lookups to verify or refute bug claims.
Use Case: After a security scan flags a potential SQL injection, the Skeptic Skill reviews the code and framework context to determine if the ORM inherently prevents the injection, thus marking it as a false positive.

Quick Start

Use the skeptic skill to review the findings in the attached file 'hunter-findings.json'.

Frequently Asked Questions about skeptic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate security findings and eliminate false positives during code review?▼

To validate security findings and eliminate false positives, perform adversarial code review by re-reading the code, verifying framework behaviors against documentation, and challenging reported vulnerabilities to ensure only genuine bugs are escalated.

What is adversarial testing for vulnerability validation in a bug hunting pipeline?▼

Adversarial testing for vulnerability validation critically evaluates bug findings by looking for reasons to disprove them, acting as an immune system to prevent wasted developer time on non-issues.

How do I review a JSON file of bug findings to filter out non-issues?▼

To review a JSON file of bug findings, use the skeptic skill to analyze the attached file 'hunter-findings.json', which requires rigorous analysis of code context to identify and filter out false positives.

Can I use contextual framework analysis to refute a reported SQL injection?▼

Yes, contextual framework analysis can refute a reported SQL injection by verifying if the ORM inherently prevents the injection, using framework knowledge and documentation lookups to mark it as a false positive.

What is the best way to challenge reported vulnerabilities before escalating them to developers?▼

The best way to challenge reported vulnerabilities is through rigorous adversarial code review that verifies framework behaviors against documentation and requires JSON output of findings to ensure only valid issues are escalated.

Does adversarial code review require access to the full code context to verify bug claims?▼

Yes, adversarial code review requires access to code context for rigorous analysis, utilizing framework knowledge and documentation lookups to critically evaluate findings and verify or refute bug claims.