skills.rest
florianbuetow
florianbuetowCOMMUNITY
Explore all skills by this author →
Website𝕏@bytetweetsGitHub

verify

Re-run detection methods to verify security fixes and update findings.

12|1|Updated Feb 9, 2026
Search Tags:#testing#security#vulnerability#verification#fix#appsec
One-click install
npx skills add https://github.com/florianbuetow/claude-code --skill verify-florianbuetow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: verify
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/verify
Command: npx skills add https://github.com/florianbuetow/claude-code --skill verify-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill ensures that security patches and fixes applied by developers actually resolve the reported vulnerabilities, preventing regressions and maintaining a secure codebase.

Core Features & Use Cases

  • Automated Re-testing: Re-runs the original scanner rule or analysis that detected a vulnerability.
  • Vulnerability Verification: Provides a clear verdict (FIXED or STILL VULNERABLE) with explanations.
  • Finding Management: Updates the status of findings in .appsec/findings.json and logs historical data.
  • Use Case: After a developer applies a fix for a Cross-Site Scripting (XSS) vulnerability, this Skill can automatically re-test the affected code to confirm the fix is in place and effective, providing immediate feedback.

Quick Start

Use the appsec verify skill to check if the vulnerability with ID 'INJ-001' has been fixed.

Frequently Asked Questions about verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a security fix is effective after patching a vulnerability?▼

To verify a security fix is effective, re-run the original detection method against the patched code location. This confirms whether the vulnerability is resolved or still present, returning a clear FIXED or STILL VULNERABLE verdict with actionable explanations.

What is the best way to re-test code for vulnerabilities after applying a patch?▼

The best way to re-test patched code for vulnerabilities is to automatically re-run the original scanner rule or analysis that detected the issue. This validates fix integrity and checks for potential bypass attempts in the updated codebase.

Can I automatically update finding status logs when a vulnerability is confirmed fixed?▼

Yes, finding status updates and historical logging are automatically managed within the .appsec/findings.json and .appsec/fixed-history.json files. This ensures security findings are accurately tracked when a fix is verified.

Does vulnerability verification detect bypass attempts in patched code?▼

Yes, vulnerability verification supports detailed analysis of fix integrity and potential bypass attempts. By re-running original detection methods against vulnerable code locations, it identifies if the applied security fix was successfully circumvented.

When do I need to run vulnerability verification on my codebase?▼

You need to run vulnerability verification immediately after a developer applies a security patch, such as fixing a Cross-Site Scripting (XSS) vulnerability. This prevents regressions and maintains a secure codebase by confirming the fix is in place.

Related Skills

Explore More Software Engineering Skills→
florianbuetowflorianbuetow
12

status

Generate a security posture dashboard from .appsec/findings.json and .appsec/last-run.json.

Community
Intermediate
djankiesdjankies

reviewing-dependencies

Detect unused, outdated, and vulnerable dependencies in npm projects.

Community
Advanced
dakshrawat298-gifdakshrawat298-gif

security-fix-review

Review security patches for root-cause coverage and bypass risks.

Community
Intermediate
EojEdredEojEdred

security-hardening

Scan code and configurations for security vulnerabilities and replay risks.

Community
Intermediate