fp-check
Systematic false positive verification for security findings. Provides structured methodology to confirm or dismiss scanner results, manual audit findings, and automated alerts. Adapted from Trail of Bits. Use when triaging security scan results or verifying audit findings.
npx skills add vibeeval/vibecosystem --skill fp-check --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# False Positive Verification Not every finding is real. But dismissing a real finding as "false positive" is worse than investigating a false one. This skill provides a systematic approach to verify findings without bias. ## Verification Process ### Step 1: Reproduce the Claim Before dismissing anything, attempt to confirm: ``` FINDING: SQL injection in /api/users CLAIM: User input reaches database query unsanitized VERIFICATION: 1. Read the actual code at the reported location 2. Trace the data flow from input to sink 3. Check for sanitization/validation between input and sink 4. Check for framework-level protections (ORM, parameterized queries) 5. Attempt to construct an exploit payload ``` ### Step 2: Evidence-Based Triage | Verdict | Criteria | Evidence Required | |---------|----------|-------------------| | TRUE POSITIVE | Vulnerability exists and is exploitable | Code path + exploit scenario | | TRUE POSITIVE (mitigated) | Vulnerability exists but other controls prevent exploitation | Code path + mitigation proof | | FALSE POSITIVE (provable) | Finding is wrong due to tool limitation | Specific reason why tool was wrong | | FALSE POSITIVE (contextual) | Code is technically f
- Verification Process
- Step 1: Reproduce the Claim
- Step 2: Evidence-Based Triage
- Step 3: Document the Decision
- Common False Positive Patterns
- 1. Scanner Doesn't Understand Context
- 2. Framework Protection Not Recognized
- 3. Dead Code / Unreachable Path
- 4. Test Code Flagged
- 5. Intentional Behavior
- Red Flags: When "False Positive" Is Actually Real
- Verification Techniques
- 1. Data Flow Tracing
- 2. Control Flow Analysis
Has this code had real vulnerabilities before? git log --grep="fix\|vuln\|security\|CVE" -- <file> Has the scanner been wrong about this pattern before? Check past triage decisions for this rule
What does the fp-check skill do?
Systematic false positive verification for security findings. Provides structured methodology to confirm or dismiss scanner results, manual audit findings, and automated alerts. Adapted from Trail of Bits. Use when triaging security scan results or verifying audit findings.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill fp-check --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.