verify

Re-run detection methods to verify security fixes and update findings.

12|1|Updated Feb 9, 2026

Search Tags:#testing #security #vulnerability #verification #fix #appsec

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill verify-florianbuetow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: verify
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/verify
Command: npx skills add https://github.com/florianbuetow/claude-code --skill verify-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill ensures that security patches and fixes applied by developers actually resolve the reported vulnerabilities, preventing regressions and maintaining a secure codebase.

Core Features & Use Cases

Automated Re-testing: Re-runs the original scanner rule or analysis that detected a vulnerability.
Vulnerability Verification: Provides a clear verdict (FIXED or STILL VULNERABLE) with explanations.
Finding Management: Updates the status of findings in .appsec/findings.json and logs historical data.
Use Case: After a developer applies a fix for a Cross-Site Scripting (XSS) vulnerability, this Skill can automatically re-test the affected code to confirm the fix is in place and effective, providing immediate feedback.

Quick Start

Use the appsec verify skill to check if the vulnerability with ID 'INJ-001' has been fixed.

Frequently Asked Questions about verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify a security fix is effective after patching a vulnerability?▼

To verify a security fix is effective, re-run the original detection method against the patched code location. This confirms whether the vulnerability is resolved or still present, returning a clear FIXED or STILL VULNERABLE verdict with actionable explanations.

What is the best way to re-test code for vulnerabilities after applying a patch?▼

The best way to re-test patched code for vulnerabilities is to automatically re-run the original scanner rule or analysis that detected the issue. This validates fix integrity and checks for potential bypass attempts in the updated codebase.

Can I automatically update finding status logs when a vulnerability is confirmed fixed?▼

Yes, finding status updates and historical logging are automatically managed within the .appsec/findings.json and .appsec/fixed-history.json files. This ensures security findings are accurately tracked when a fix is verified.

Does vulnerability verification detect bypass attempts in patched code?▼

Yes, vulnerability verification supports detailed analysis of fix integrity and potential bypass attempts. By re-running original detection methods against vulnerable code locations, it identifies if the applied security fix was successfully circumvented.

When do I need to run vulnerability verification on my codebase?▼

You need to run vulnerability verification immediately after a developer applies a security patch, such as fixing a Cross-Site Scripting (XSS) vulnerability. This prevents regressions and maintains a secure codebase by confirming the fix is in place.