fp-check
仓库创建 2026年1月15日最近提交 6 天前SkillHot 收录 20 天前
▸ 精选理由
能系统化判断可利用性，节省安全复审时间
▸ 风险提示
可能涉及漏洞利用细节，具一定双用性
这个 Skill 做什么
核实安全发现真伪，输出可复现的真阳性或误报证据与结论
帮你把怀疑的安全漏洞弄清楚：会系统复现并调查论证，然后给出 TRUE POSITIVE 或 FALSE POSITIVE 的结论，附上可复现的证据和复查步骤。适合有人问“这个漏洞是真实可利用吗？”或“这是误报吗？”的时候用，而不是用来发现新漏洞。特别之处是出具可复现的证据链，方便后续修复或上报。
▸ 展开 SKILL.md 英文原文
Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.
6.3k
Stars
542
Forks
40
仓库内 Skill
+270
7 日增星
安装 / 使用
给你的 Agent 一句话（通用）
帮我安装这个 skill：https://raw.githubusercontent.com/trailofbits/skills/main/plugins/fp-check/skills/fp-check/SKILL.md或 curl 直取 SKILL.md
curl -fsSL "https://raw.githubusercontent.com/trailofbits/skills/main/plugins/fp-check/skills/fp-check/SKILL.md"SKILL.MD 节选查看完整文件 ↗
# False Positive Check
## When to Use
- "Is this bug real?" or "is this a true positive?"
- "Is this a false positive?" or "verify this finding"
- "Check if this vulnerability is exploitable"
- Any request to verify or validate a specific suspected bug
## When NOT to Use
- Finding or hunting for bugs ("find bugs", "security analysis", "audit code")
- General code review for style, performance, or maintainability
- Feature development, refactoring, or non-security tasks
- When the user explicitly asks for a quick scan without verification
## Rationalizations to Reject
If you catch yourself thinking any of these, STOP.
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有