skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

11|1|Updated May 4, 2026
Search Tags:#penetration testing#web security#red teaming#vulnerability triage#severity calibration#false positive filtering
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill vuln-critic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-critic
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/vuln-critic
Command: npx skills add https://github.com/dreadnode/capabilities --skill vuln-critic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams and penetration testers waste significant time manually verifying low-quality, false positive vulnerability findings from automated scanners and AI agents. This skill acts as an adversarial pre-filter to triage findings before hands-on testing, eliminating wasted effort on non-issues.

Core Features & Use Cases

  • Evidence Quality Assessment: Evaluates each finding for specificity, evidence chain completeness, and reproducibility to gauge how much trust to place in the report.
  • False Positive Pattern Matching: Auto-rejects known low-value findings like missing security headers without exploitation scenarios or self-XSS that only affects the attacker's own session.
  • Severity Calibration: Re-ranks findings based on actual demonstrated impact rather than agent claims, so teams prioritize real, high-risk vulnerabilities first.
  • Use Case: A red team running a web application pentest can feed all scanner and agent output into this skill to get a prioritized list of only high-confidence findings to test, skipping obvious false positives.

Quick Start

Use the vuln-critic skill to triage and prioritize all findings from your latest web application penetration test.

Frequently Asked Questions about vuln-critic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I filter false positive vulnerability findings from automated scanner output?▼

Filter false positive vulnerability findings by applying evidence quality assessment and pattern matching to scanner output, eliminating wasted testing time on known low-value issues like missing security headers or self-XSS before manual verification.

What is vulnerability triage and how does it improve penetration testing workflows?▼

Vulnerability triage is the process of pre-filtering automated scanner findings to assess evidence quality, match false positive patterns, and re-rank severity based on actual impact, ensuring red teaming efforts focus only on high-confidence findings.

How do I calibrate vulnerability severity based on actual demonstrated impact?▼

Calibrate vulnerability severity by re-ranking findings based on actual demonstrated impact rather than agent claims, evaluating each finding for specificity, evidence chain completeness, and reproducibility to prioritize real high-risk vulnerabilities first.

Can I use this skill to triage web application pentest findings from AI agents?▼

Yes, you can use this skill to triage web application pentest findings from AI agents by feeding all scanner and agent output into it to get a prioritized list of only high-confidence findings for exploit verification.

What are common false positive patterns in web security scanner reports?▼

Common false positive patterns in web security scanner reports include missing security headers without exploitation scenarios and self-XSS that only affects the attacker's own session, which are auto-rejected during evidence-based vulnerability triage.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

vulnerability-scan-triage

Normalize and deduplicate vulnerability scan findings from multiple scanners.

Community
Intermediate
DammianMillerDammianMiller
1

adversarial

Enumerate and test attack vectors to bypass security controls.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

cybersecurity

Automate security audits, penetration testing, and CTF competitions with security tools.

Community
Advanced
ofelixdevofelixdev

fp-check

Verify suspected security bugs and produce TRUE POSITIVE or FALSE POSITIVE verdicts.

Community
Advanced