finding-discipline

仓库创建 2026年5月19日最近提交 24 天前SkillHot 收录 21 天前

⬈ GitHub 仓库 ⬈ SKILL.md 原文件 ⬇ Raw 原始文件

▸ 精选理由

防止误报，提升报告可信度与复现性。

▸ 风险提示

整理攻击证据与清单有被滥用的潜在风险。

这个 Skill 做什么

记录、验证并为安全发现设定证据与严重度标准。

把每个安全发现当成需要复现和证明的断言：没有可重现证据就别标记为 [CONFIRMED]。在记录、评估严重度或写报告前先做能复现的测试并收集证据，像 TDD 一样用“证明”来决定是否成立。这个流程能明显降低误报、夸大影响和沟通成本。

▸ 展开 SKILL.md 英文原文

Use when about to record, claim, rate the severity of, or report any security finding — before marking anything [CONFIRMED] or writing it into the report

Skill 开发管理发现规范证据链严重度评估通用

326

Stars

Forks

仓库内 Skill

+15

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/hypnguyen1209/offensive-claude/main/skills/finding-discipline/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/hypnguyen1209/offensive-claude/main/skills/finding-discipline/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Finding Discipline

## Overview

**The Iron Law: No `[CONFIRMED]` without proof.** A finding is a claim about real, demonstrated
impact — not a status code, a reflected string, or a hunch. This is the offensive equivalent of
test-driven development: the proof is the test, and the finding does not exist until it passes.

**Violating the letter of this rule is violating its spirit.**

## The three tiers

- **`[CONFIRMED]`** — impact demonstrated AND grounded in an evidence artifact that exists on disk.
- **`[POSSIBLE]`** — reachable but the class proof bar is not yet met. Keep digging; do not report as real.
- **`[INFO]`** — true but no security impact at the claimed severity.

## The proof

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有