Vulnerability Validation

codexstar69/bug-hunter/skills/vulnerability-validation

by codexstar693be69733a27aa04d4f5620df203c05350d162067No license519 starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 7 weeks ago

Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.

Instructions onlySecurity

AI-generated overview

Validates suspected security findings for reachability, exploitability and real-world impact, producing CVSS scores and proof-of-concept notes.

What it does: This skill takes suspected or confirmed security findings, preferably from Bug Hunter artifacts such as hunter-findings.json and threat-model.md, and isolates the security-relevant ones. It traces whether the vulnerable path is reachable (external, authenticated, internal or unreachable) and how exploitable it is (easy, medium, hard or not exploitable), and checks for existing mitigations in code, framework behavior or deployment assumptions. For confirmed high or critical bugs it generates an exploitation path, a benign proof of concept and a CVSS vector and score, writing results into Bug Hunter-compatible artifacts such as referee.json, report.md or validated-findings.json.
When to use it: Use it after security scans, before patch generation, or whenever someone wants confirmation that a suspected vulnerability is actually exploitable. It fits workflows that already use Bug Hunter-native findings and want explicit reasoning about false positives.
Requirements: Instructions only; no scripts are shipped. It expects Bug Hunter-native artifacts under a .bug-hunter directory (for example hunter-findings.json, threat-model.md, security-config.json and optionally dep-findings.json) and writes outputs back into that directory.