fp-check
Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.
Profile →npx skills add waybarrios/opencode-power-pack --skill fp-check --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# False Positive Check ## When to Use - "Is this bug real?" or "is this a true positive?" - "Is this a false positive?" or "verify this finding" - "Check if this vulnerability is exploitable" - Any request to verify or validate a specific suspected bug ## When NOT to Use - Finding or hunting for bugs ("find bugs", "security analysis", "audit code") - General code review for style, performance, or maintainability - Feature development, refactoring, or non-security tasks - When the user explicitly asks for a quick scan without verification ## Rationalizations to Reject If you catch yourself thinking any of these, STOP. | Rationalization | Why It's Wrong | Required Action | |---|---|---| | "Rapid analysis of remaining bugs" | Every bug gets full verification | Return to task list, verify next bug through all phases | | "This pattern looks dangerous, so it's a vulnerability" | Pattern recognition is not analysis | Complete data flow tracing before any conclusion | | "Skipping full verification for efficiency" | No partial analysis allowed | Execute all steps per the chosen verification path | | "The code looks unsafe, reporting without tracing data flow" | Unsafe-looking code may have
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Step 0: Understand the Claim and Context
- Route: Standard vs Deep Verification
- Standard Verification
- Deep Verification
- Default
- Batch Triage
- Final Summary
- References
What does the fp-check skill do?
Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.
How do I install it?
Run `npx skills add waybarrios/opencode-power-pack --skill fp-check --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From waybarrios/opencode-power-pack, a repository with 443 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.