What problem does it solve? AI-generated vulnerability reports are often unverified hypotheses that waste maintainer time and erode trust in security research. This Skill enforces a reproduce-before-report discipline so every finding you escalate is backed by a runnable command, scored against the project's actual threat model, and independently refuted before it leaves the session. ## Core Features & Use Cases - Threat-model scoring: Evaluates every candidate against the repo's SECURITY.md claims and out-of-scope list, so you only report breaks of claims the project actually makes. - Three-tier evidence standard: Classifies findings as a failing test, a live boundary transcript, or a code trace, and requires you to state which level you reached. - Tool corroboration: Routes checks through the scanners already wired into the tree (bandit, osv-scanner, grype, CodeQL, Stryker, Hypothesis) instead of re-deriving results by hand. - Independent refutation: Spawns a fresh sub-agent tasked with disproving the finding before escalation, and records its verdict in the report. - Bounded disclosure: Caps reports at 300 words per finding in a fixed five-part format, and routes all external disclosure through a human. - Use Case: A scanner flags a possible sandbox escape in the audit-log path. You reproduce it with a failing test, confirm it breaks a specific SECURITY.md claim, have a sub-agent attempt refutation, then hand the maintainer a concise report ready for a private advisory. ## Quick Start Ask the AI to audit this repository for security vulnerabilities and report only findings it can reproduce against the threat model in SECURITY.md.
