What problem does it solve? Security scans produce candidate findings that may be false positives or unproven claims. This Skill determines whether each candidate vulnerability is real by attempting reproduction or rigorous code tracing, so teams only act on evidence-backed findings. ## Core Features & Use Cases - Evidence-Based Validation: Attempts crashing PoCs, valgrind/ASan runs, debugger traces, focused tests, and realistic interface reproduction before falling back to static source-to-sink tracing. - Instance-Preserving Coverage: Validates every candidate instance independently, preserving ledger rows with explicit reportable, suppressed, not_applicable, or deferred dispositions. - Use Case: After a repository-wide security scan produces a candidate ledger of suspected SQL injection and path traversal findings, run this Skill to reproduce each one, suppress false positives with exact counterevidence, and emit a validation closure table with confidence levels. ## Quick Start Ask the AI to validate the candidate security findings in the scan's candidate ledger and produce an evidence-backed disposition for each one.
