verify

Re-run finding reproductions against repository HEAD and output a verification report.

Updated May 20, 2026

Search Tags:#codebase #verify #reproduction #security-audit #finding #head

Ready to run

npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill verify-lukehinds

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: verify
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/verify
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill verify-lukehinds

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Independently verify a specific finding by re-running its reproduction against the current repository state. This process records whether the finding still reproduces, was fixed upstream, or could not be reproduced, enabling informed disclosure decisions.

Core Features & Use Cases

Re-run validated reproductions against HEAD to confirm ongoing risk.
Determine if changes in the codebase have eliminated or altered the dangerous behavior described in a finding.
Supports finding-scoped verification with a provided context.json and reproduction steps.

Quick Start

Use the verify skill to re-run a finding's reproduction against the repository HEAD and classify whether the issue still occurs.

Frequently Asked Questions about verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify a security finding against the current codebase HEAD?▼

To verify a security finding against the current codebase HEAD, the Skill reads a finding_id from context.json, fetches reproduction steps from the scrutineer API, and re-runs them exactly as described. It outputs a structured report classifying whether the issue still occurs or was fixed.

What is the process for re-running a security audit reproduction against a repository?▼

Re-running a security audit reproduction involves fetching the original six-step validation prose for a finding and executing only those exact steps against the repository HEAD. This determines if the dangerous behavior described in the finding still occurs in the current codebase state.

Can I check if a specific vulnerability finding has been fixed in the latest code commit?▼

Yes, you can check if a vulnerability finding has been fixed by re-running its validated reproduction against the repository HEAD. The verification process compares the current codebase state against the original finding's location and CWE to output a status confirming if the risk is ongoing or resolved.

How do I reproduce a security finding using exact validation steps from an API?▼

You reproduce a security finding by fetching its title, severity, location, and six-step reproduction prose from the scrutineer API using a finding_id. The verification follows only the exact steps described in the validation field to determine if the dangerous behavior still occurs.

What limitations exist when verifying a finding's reproduction against a repository HEAD?▼

A key limitation is that verification strictly follows the exact steps described in the finding's validation field and only those steps. If the codebase has changed significantly since the finding was created, the re-run may classify the result as could not be reproduced rather than confirming a fix.

Do I need a context.json file to classify whether a security issue still occurs?▼

Yes, a context.json file containing the finding_id is required to classify whether a security issue still occurs. The Skill reads this identifier to fetch the necessary finding metadata, CWE, and reproduction steps from the scrutineer API before executing the validation against the repository HEAD.