[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-fp-check":3,"mdc-sef7ou-key":38,"related-org-trail-of-bits-fp-check":712,"related-repo-trail-of-bits-fp-check":864},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":33,"sourceUrl":36,"mdContent":37},"fp-check","verify security bug findings","Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",{"name":24,"slug":25,"type":16},"Debugging","debugging",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:10.969129",null,541,[32],"agent-skills",{"repoUrl":27,"stars":26,"forks":30,"topics":34,"description":35},[32],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ffp-check\u002Fskills\u002Ffp-check","---\nname: fp-check\ndescription: \"Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.\"\nallowed-tools: Read Grep Glob LSP Bash Task Write Edit AskUserQuestion TaskCreate TaskUpdate TaskList TaskGet\n---\n\n# False Positive Check\n\n## When to Use\n\n- \"Is this bug real?\" or \"is this a true positive?\"\n- \"Is this a false positive?\" or \"verify this finding\"\n- \"Check if this vulnerability is exploitable\"\n- Any request to verify or validate a specific suspected bug\n\n## When NOT to Use\n\n- Finding or hunting for bugs (\"find bugs\", \"security analysis\", \"audit code\")\n- General code review for style, performance, or maintainability\n- Feature development, refactoring, or non-security tasks\n- When the user explicitly asks for a quick scan without verification\n\n## Rationalizations to Reject\n\nIf you catch yourself thinking any of these, STOP.\n\n| Rationalization | Why It's Wrong | Required Action |\n|---|---|---|\n| \"Rapid analysis of remaining bugs\" | Every bug gets full verification | Return to task list, verify next bug through all phases |\n| \"This pattern looks dangerous, so it's a vulnerability\" | Pattern recognition is not analysis | Complete data flow tracing before any conclusion |\n| \"Skipping full verification for efficiency\" | No partial analysis allowed | Execute all steps per the chosen verification path |\n| \"The code looks unsafe, reporting without tracing data flow\" | Unsafe-looking code may have upstream validation | Trace the complete path from source to sink |\n| \"Similar code was vulnerable elsewhere\" | Each context has different validation, callers, and protections | Verify this specific instance independently |\n| \"This is clearly critical\" | LLMs are biased toward seeing bugs and overrating severity | Complete devil's advocate review; prove it with evidence |\n\n---\n\n## Step 0: Understand the Claim and Context\n\nBefore any analysis, restate the bug in your own words. If you cannot do this clearly, ask the user for clarification. Half of false positives collapse at this step — the claim doesn't make coherent sense when restated precisely.\n\nDocument:\n\n- **What is the exact vulnerability claim?** (e.g., \"heap buffer overflow in `parse_header()` when `content_length` exceeds 4096\")\n- **What is the alleged root cause?** (e.g., \"missing bounds check before `memcpy` at line 142\")\n- **What is the supposed trigger?** (e.g., \"attacker sends HTTP request with oversized Content-Length header\")\n- **What is the claimed impact?** (e.g., \"remote code execution via controlled heap corruption\")\n- **What is the threat model?** What privilege level does this code run at? Is it sandboxed? What can the attacker already do before triggering this bug? (e.g., \"unauthenticated remote attacker vs privileged local user\"; \"runs inside Chrome renderer sandbox\" vs \"runs as root with no sandbox\")\n- **What is the bug class?** Classify the bug and consult [bug-class-verification.md]({baseDir}\u002Freferences\u002Fbug-class-verification.md) for class-specific verification requirements that supplement the generic phases below.\n- **Execution context**: When and how is this code path reached during normal execution?\n- **Caller analysis**: What functions call this code and what input constraints do they impose?\n- **Architectural context**: Is this part of a larger security system with multiple protection layers?\n- **Historical context**: Any recent changes, known issues, or previous security reviews of this code area?\n\n## Route: Standard vs Deep Verification\n\nAfter Step 0, choose a verification path.\n\n### Standard Verification\n\nUse when ALL of these hold:\n\n- Clear, specific vulnerability claim (not vague or ambiguous)\n- Single component — no cross-component interaction in the bug path\n- Well-understood bug class (buffer overflow, SQL injection, XSS, integer overflow, etc.)\n- No concurrency or async involved in the trigger\n- Straightforward data flow from source to sink\n\nFollow [standard-verification.md]({baseDir}\u002Freferences\u002Fstandard-verification.md). No task tracking — work through the linear checklist sequentially, documenting findings inline.\n\n### Deep Verification\n\nUse when ANY of these hold:\n\n- Ambiguous claim that could be interpreted multiple ways\n- Cross-component bug path (data flows through 3+ modules or services)\n- Race conditions, TOCTOU, or concurrency in the trigger mechanism\n- Logic bugs without a clear spec to verify against\n- Standard verification was inconclusive or escalated\n- User explicitly requests full verification\n\nFollow [deep-verification.md]({baseDir}\u002Freferences\u002Fdeep-verification.md). Track each phase as a task with explicit dependencies, and execute the phases using the plugin's analysis agents.\n\n### Default\n\nStart with standard. Standard verification has two built-in escalation checkpoints that route to deep when complexity exceeds the linear checklist.\n\n## Batch Triage\n\nWhen verifying multiple bugs at once:\n\n1. Run Step 0 for all bugs first — restating each claim often collapses obvious false positives immediately\n2. Route each bug independently (some may be standard, others deep)\n3. Process all standard-routed bugs first, then deep-routed bugs\n4. After all bugs are verified, check for **exploit chains** — findings that individually failed gate review may combine to form a viable attack\n\n## Final Summary\n\nAfter processing ALL suspected bugs, provide:\n\n1. **Counts**: X TRUE POSITIVES, Y FALSE POSITIVES\n2. **TRUE POSITIVE list**: Each with brief vulnerability description\n3. **FALSE POSITIVE list**: Each with brief reason for rejection\n\n## References\n\n- [Standard Verification]({baseDir}\u002Freferences\u002Fstandard-verification.md) — Linear single-pass checklist for straightforward bugs\n- [Deep Verification]({baseDir}\u002Freferences\u002Fdeep-verification.md) — Full task-based orchestration for complex bugs\n- [Gate Reviews]({baseDir}\u002Freferences\u002Fgate-reviews.md) — Six mandatory gates and verdict format\n- [Bug-Class Verification]({baseDir}\u002Freferences\u002Fbug-class-verification.md) — Class-specific verification requirements for memory corruption, logic bugs, race conditions, integer issues, crypto, injection, info disclosure, DoS, and deserialization\n- [False Positive Patterns]({baseDir}\u002Freferences\u002Ffalse-positive-patterns.md) — 13-item checklist and red flags for common false positive patterns\n- [Evidence Templates]({baseDir}\u002Freferences\u002Fevidence-templates.md) — Documentation templates for data flow, mathematical proofs, attacker control, and devil's advocate reviews\n",{"data":39,"body":41},{"name":4,"description":6,"allowed-tools":40},"Read Grep Glob LSP Bash Task Write Edit AskUserQuestion TaskCreate TaskUpdate TaskList TaskGet",{"type":42,"children":43},"root",[44,53,60,85,91,114,120,126,267,271,277,282,287,425,431,436,443,448,476,489,495,500,533,545,551,556,562,567,598,604,609,642,648],{"type":45,"tag":46,"props":47,"children":49},"element","h1",{"id":48},"false-positive-check",[50],{"type":51,"value":52},"text","False Positive Check",{"type":45,"tag":54,"props":55,"children":57},"h2",{"id":56},"when-to-use",[58],{"type":51,"value":59},"When to Use",{"type":45,"tag":61,"props":62,"children":63},"ul",{},[64,70,75,80],{"type":45,"tag":65,"props":66,"children":67},"li",{},[68],{"type":51,"value":69},"\"Is this bug real?\" or \"is this a true positive?\"",{"type":45,"tag":65,"props":71,"children":72},{},[73],{"type":51,"value":74},"\"Is this a false positive?\" or \"verify this finding\"",{"type":45,"tag":65,"props":76,"children":77},{},[78],{"type":51,"value":79},"\"Check if this vulnerability is exploitable\"",{"type":45,"tag":65,"props":81,"children":82},{},[83],{"type":51,"value":84},"Any request to verify or validate a specific suspected bug",{"type":45,"tag":54,"props":86,"children":88},{"id":87},"when-not-to-use",[89],{"type":51,"value":90},"When NOT to Use",{"type":45,"tag":61,"props":92,"children":93},{},[94,99,104,109],{"type":45,"tag":65,"props":95,"children":96},{},[97],{"type":51,"value":98},"Finding or hunting for bugs (\"find bugs\", \"security analysis\", \"audit code\")",{"type":45,"tag":65,"props":100,"children":101},{},[102],{"type":51,"value":103},"General code review for style, performance, or maintainability",{"type":45,"tag":65,"props":105,"children":106},{},[107],{"type":51,"value":108},"Feature development, refactoring, or non-security tasks",{"type":45,"tag":65,"props":110,"children":111},{},[112],{"type":51,"value":113},"When the user explicitly asks for a quick scan without verification",{"type":45,"tag":54,"props":115,"children":117},{"id":116},"rationalizations-to-reject",[118],{"type":51,"value":119},"Rationalizations to Reject",{"type":45,"tag":121,"props":122,"children":123},"p",{},[124],{"type":51,"value":125},"If you catch yourself thinking any of these, STOP.",{"type":45,"tag":127,"props":128,"children":129},"table",{},[130,154],{"type":45,"tag":131,"props":132,"children":133},"thead",{},[134],{"type":45,"tag":135,"props":136,"children":137},"tr",{},[138,144,149],{"type":45,"tag":139,"props":140,"children":141},"th",{},[142],{"type":51,"value":143},"Rationalization",{"type":45,"tag":139,"props":145,"children":146},{},[147],{"type":51,"value":148},"Why It's Wrong",{"type":45,"tag":139,"props":150,"children":151},{},[152],{"type":51,"value":153},"Required Action",{"type":45,"tag":155,"props":156,"children":157},"tbody",{},[158,177,195,213,231,249],{"type":45,"tag":135,"props":159,"children":160},{},[161,167,172],{"type":45,"tag":162,"props":163,"children":164},"td",{},[165],{"type":51,"value":166},"\"Rapid analysis of remaining bugs\"",{"type":45,"tag":162,"props":168,"children":169},{},[170],{"type":51,"value":171},"Every bug gets full verification",{"type":45,"tag":162,"props":173,"children":174},{},[175],{"type":51,"value":176},"Return to task list, verify next bug through all phases",{"type":45,"tag":135,"props":178,"children":179},{},[180,185,190],{"type":45,"tag":162,"props":181,"children":182},{},[183],{"type":51,"value":184},"\"This pattern looks dangerous, so it's a vulnerability\"",{"type":45,"tag":162,"props":186,"children":187},{},[188],{"type":51,"value":189},"Pattern recognition is not analysis",{"type":45,"tag":162,"props":191,"children":192},{},[193],{"type":51,"value":194},"Complete data flow tracing before any conclusion",{"type":45,"tag":135,"props":196,"children":197},{},[198,203,208],{"type":45,"tag":162,"props":199,"children":200},{},[201],{"type":51,"value":202},"\"Skipping full verification for efficiency\"",{"type":45,"tag":162,"props":204,"children":205},{},[206],{"type":51,"value":207},"No partial analysis allowed",{"type":45,"tag":162,"props":209,"children":210},{},[211],{"type":51,"value":212},"Execute all steps per the chosen verification path",{"type":45,"tag":135,"props":214,"children":215},{},[216,221,226],{"type":45,"tag":162,"props":217,"children":218},{},[219],{"type":51,"value":220},"\"The code looks unsafe, reporting without tracing data flow\"",{"type":45,"tag":162,"props":222,"children":223},{},[224],{"type":51,"value":225},"Unsafe-looking code may have upstream validation",{"type":45,"tag":162,"props":227,"children":228},{},[229],{"type":51,"value":230},"Trace the complete path from source to sink",{"type":45,"tag":135,"props":232,"children":233},{},[234,239,244],{"type":45,"tag":162,"props":235,"children":236},{},[237],{"type":51,"value":238},"\"Similar code was vulnerable elsewhere\"",{"type":45,"tag":162,"props":240,"children":241},{},[242],{"type":51,"value":243},"Each context has different validation, callers, and protections",{"type":45,"tag":162,"props":245,"children":246},{},[247],{"type":51,"value":248},"Verify this specific instance independently",{"type":45,"tag":135,"props":250,"children":251},{},[252,257,262],{"type":45,"tag":162,"props":253,"children":254},{},[255],{"type":51,"value":256},"\"This is clearly critical\"",{"type":45,"tag":162,"props":258,"children":259},{},[260],{"type":51,"value":261},"LLMs are biased toward seeing bugs and overrating severity",{"type":45,"tag":162,"props":263,"children":264},{},[265],{"type":51,"value":266},"Complete devil's advocate review; prove it with evidence",{"type":45,"tag":268,"props":269,"children":270},"hr",{},[],{"type":45,"tag":54,"props":272,"children":274},{"id":273},"step-0-understand-the-claim-and-context",[275],{"type":51,"value":276},"Step 0: Understand the Claim and Context",{"type":45,"tag":121,"props":278,"children":279},{},[280],{"type":51,"value":281},"Before any analysis, restate the bug in your own words. If you cannot do this clearly, ask the user for clarification. Half of false positives collapse at this step — the claim doesn't make coherent sense when restated precisely.",{"type":45,"tag":121,"props":283,"children":284},{},[285],{"type":51,"value":286},"Document:",{"type":45,"tag":61,"props":288,"children":289},{},[290,318,336,346,356,366,385,395,405,415],{"type":45,"tag":65,"props":291,"children":292},{},[293,299,301,308,310,316],{"type":45,"tag":294,"props":295,"children":296},"strong",{},[297],{"type":51,"value":298},"What is the exact vulnerability claim?",{"type":51,"value":300}," (e.g., \"heap buffer overflow in ",{"type":45,"tag":302,"props":303,"children":305},"code",{"className":304},[],[306],{"type":51,"value":307},"parse_header()",{"type":51,"value":309}," when ",{"type":45,"tag":302,"props":311,"children":313},{"className":312},[],[314],{"type":51,"value":315},"content_length",{"type":51,"value":317}," exceeds 4096\")",{"type":45,"tag":65,"props":319,"children":320},{},[321,326,328,334],{"type":45,"tag":294,"props":322,"children":323},{},[324],{"type":51,"value":325},"What is the alleged root cause?",{"type":51,"value":327}," (e.g., \"missing bounds check before ",{"type":45,"tag":302,"props":329,"children":331},{"className":330},[],[332],{"type":51,"value":333},"memcpy",{"type":51,"value":335}," at line 142\")",{"type":45,"tag":65,"props":337,"children":338},{},[339,344],{"type":45,"tag":294,"props":340,"children":341},{},[342],{"type":51,"value":343},"What is the supposed trigger?",{"type":51,"value":345}," (e.g., \"attacker sends HTTP request with oversized Content-Length header\")",{"type":45,"tag":65,"props":347,"children":348},{},[349,354],{"type":45,"tag":294,"props":350,"children":351},{},[352],{"type":51,"value":353},"What is the claimed impact?",{"type":51,"value":355}," (e.g., \"remote code execution via controlled heap corruption\")",{"type":45,"tag":65,"props":357,"children":358},{},[359,364],{"type":45,"tag":294,"props":360,"children":361},{},[362],{"type":51,"value":363},"What is the threat model?",{"type":51,"value":365}," What privilege level does this code run at? Is it sandboxed? What can the attacker already do before triggering this bug? (e.g., \"unauthenticated remote attacker vs privileged local user\"; \"runs inside Chrome renderer sandbox\" vs \"runs as root with no sandbox\")",{"type":45,"tag":65,"props":367,"children":368},{},[369,374,376,383],{"type":45,"tag":294,"props":370,"children":371},{},[372],{"type":51,"value":373},"What is the bug class?",{"type":51,"value":375}," Classify the bug and consult ",{"type":45,"tag":377,"props":378,"children":380},"a",{"href":379},"%7BbaseDir%7D\u002Freferences\u002Fbug-class-verification.md",[381],{"type":51,"value":382},"bug-class-verification.md",{"type":51,"value":384}," for class-specific verification requirements that supplement the generic phases below.",{"type":45,"tag":65,"props":386,"children":387},{},[388,393],{"type":45,"tag":294,"props":389,"children":390},{},[391],{"type":51,"value":392},"Execution context",{"type":51,"value":394},": When and how is this code path reached during normal execution?",{"type":45,"tag":65,"props":396,"children":397},{},[398,403],{"type":45,"tag":294,"props":399,"children":400},{},[401],{"type":51,"value":402},"Caller analysis",{"type":51,"value":404},": What functions call this code and what input constraints do they impose?",{"type":45,"tag":65,"props":406,"children":407},{},[408,413],{"type":45,"tag":294,"props":409,"children":410},{},[411],{"type":51,"value":412},"Architectural context",{"type":51,"value":414},": Is this part of a larger security system with multiple protection layers?",{"type":45,"tag":65,"props":416,"children":417},{},[418,423],{"type":45,"tag":294,"props":419,"children":420},{},[421],{"type":51,"value":422},"Historical context",{"type":51,"value":424},": Any recent changes, known issues, or previous security reviews of this code area?",{"type":45,"tag":54,"props":426,"children":428},{"id":427},"route-standard-vs-deep-verification",[429],{"type":51,"value":430},"Route: Standard vs Deep Verification",{"type":45,"tag":121,"props":432,"children":433},{},[434],{"type":51,"value":435},"After Step 0, choose a verification path.",{"type":45,"tag":437,"props":438,"children":440},"h3",{"id":439},"standard-verification",[441],{"type":51,"value":442},"Standard Verification",{"type":45,"tag":121,"props":444,"children":445},{},[446],{"type":51,"value":447},"Use when ALL of these hold:",{"type":45,"tag":61,"props":449,"children":450},{},[451,456,461,466,471],{"type":45,"tag":65,"props":452,"children":453},{},[454],{"type":51,"value":455},"Clear, specific vulnerability claim (not vague or ambiguous)",{"type":45,"tag":65,"props":457,"children":458},{},[459],{"type":51,"value":460},"Single component — no cross-component interaction in the bug path",{"type":45,"tag":65,"props":462,"children":463},{},[464],{"type":51,"value":465},"Well-understood bug class (buffer overflow, SQL injection, XSS, integer overflow, etc.)",{"type":45,"tag":65,"props":467,"children":468},{},[469],{"type":51,"value":470},"No concurrency or async involved in the trigger",{"type":45,"tag":65,"props":472,"children":473},{},[474],{"type":51,"value":475},"Straightforward data flow from source to sink",{"type":45,"tag":121,"props":477,"children":478},{},[479,481,487],{"type":51,"value":480},"Follow ",{"type":45,"tag":377,"props":482,"children":484},{"href":483},"%7BbaseDir%7D\u002Freferences\u002Fstandard-verification.md",[485],{"type":51,"value":486},"standard-verification.md",{"type":51,"value":488},". No task tracking — work through the linear checklist sequentially, documenting findings inline.",{"type":45,"tag":437,"props":490,"children":492},{"id":491},"deep-verification",[493],{"type":51,"value":494},"Deep Verification",{"type":45,"tag":121,"props":496,"children":497},{},[498],{"type":51,"value":499},"Use when ANY of these hold:",{"type":45,"tag":61,"props":501,"children":502},{},[503,508,513,518,523,528],{"type":45,"tag":65,"props":504,"children":505},{},[506],{"type":51,"value":507},"Ambiguous claim that could be interpreted multiple ways",{"type":45,"tag":65,"props":509,"children":510},{},[511],{"type":51,"value":512},"Cross-component bug path (data flows through 3+ modules or services)",{"type":45,"tag":65,"props":514,"children":515},{},[516],{"type":51,"value":517},"Race conditions, TOCTOU, or concurrency in the trigger mechanism",{"type":45,"tag":65,"props":519,"children":520},{},[521],{"type":51,"value":522},"Logic bugs without a clear spec to verify against",{"type":45,"tag":65,"props":524,"children":525},{},[526],{"type":51,"value":527},"Standard verification was inconclusive or escalated",{"type":45,"tag":65,"props":529,"children":530},{},[531],{"type":51,"value":532},"User explicitly requests full verification",{"type":45,"tag":121,"props":534,"children":535},{},[536,537,543],{"type":51,"value":480},{"type":45,"tag":377,"props":538,"children":540},{"href":539},"%7BbaseDir%7D\u002Freferences\u002Fdeep-verification.md",[541],{"type":51,"value":542},"deep-verification.md",{"type":51,"value":544},". Track each phase as a task with explicit dependencies, and execute the phases using the plugin's analysis agents.",{"type":45,"tag":437,"props":546,"children":548},{"id":547},"default",[549],{"type":51,"value":550},"Default",{"type":45,"tag":121,"props":552,"children":553},{},[554],{"type":51,"value":555},"Start with standard. Standard verification has two built-in escalation checkpoints that route to deep when complexity exceeds the linear checklist.",{"type":45,"tag":54,"props":557,"children":559},{"id":558},"batch-triage",[560],{"type":51,"value":561},"Batch Triage",{"type":45,"tag":121,"props":563,"children":564},{},[565],{"type":51,"value":566},"When verifying multiple bugs at once:",{"type":45,"tag":568,"props":569,"children":570},"ol",{},[571,576,581,586],{"type":45,"tag":65,"props":572,"children":573},{},[574],{"type":51,"value":575},"Run Step 0 for all bugs first — restating each claim often collapses obvious false positives immediately",{"type":45,"tag":65,"props":577,"children":578},{},[579],{"type":51,"value":580},"Route each bug independently (some may be standard, others deep)",{"type":45,"tag":65,"props":582,"children":583},{},[584],{"type":51,"value":585},"Process all standard-routed bugs first, then deep-routed bugs",{"type":45,"tag":65,"props":587,"children":588},{},[589,591,596],{"type":51,"value":590},"After all bugs are verified, check for ",{"type":45,"tag":294,"props":592,"children":593},{},[594],{"type":51,"value":595},"exploit chains",{"type":51,"value":597}," — findings that individually failed gate review may combine to form a viable attack",{"type":45,"tag":54,"props":599,"children":601},{"id":600},"final-summary",[602],{"type":51,"value":603},"Final Summary",{"type":45,"tag":121,"props":605,"children":606},{},[607],{"type":51,"value":608},"After processing ALL suspected bugs, provide:",{"type":45,"tag":568,"props":610,"children":611},{},[612,622,632],{"type":45,"tag":65,"props":613,"children":614},{},[615,620],{"type":45,"tag":294,"props":616,"children":617},{},[618],{"type":51,"value":619},"Counts",{"type":51,"value":621},": X TRUE POSITIVES, Y FALSE POSITIVES",{"type":45,"tag":65,"props":623,"children":624},{},[625,630],{"type":45,"tag":294,"props":626,"children":627},{},[628],{"type":51,"value":629},"TRUE POSITIVE list",{"type":51,"value":631},": Each with brief vulnerability description",{"type":45,"tag":65,"props":633,"children":634},{},[635,640],{"type":45,"tag":294,"props":636,"children":637},{},[638],{"type":51,"value":639},"FALSE POSITIVE list",{"type":51,"value":641},": Each with brief reason for rejection",{"type":45,"tag":54,"props":643,"children":645},{"id":644},"references",[646],{"type":51,"value":647},"References",{"type":45,"tag":61,"props":649,"children":650},{},[651,660,669,680,690,701],{"type":45,"tag":65,"props":652,"children":653},{},[654,658],{"type":45,"tag":377,"props":655,"children":656},{"href":483},[657],{"type":51,"value":442},{"type":51,"value":659}," — Linear single-pass checklist for straightforward bugs",{"type":45,"tag":65,"props":661,"children":662},{},[663,667],{"type":45,"tag":377,"props":664,"children":665},{"href":539},[666],{"type":51,"value":494},{"type":51,"value":668}," — Full task-based orchestration for complex bugs",{"type":45,"tag":65,"props":670,"children":671},{},[672,678],{"type":45,"tag":377,"props":673,"children":675},{"href":674},"%7BbaseDir%7D\u002Freferences\u002Fgate-reviews.md",[676],{"type":51,"value":677},"Gate Reviews",{"type":51,"value":679}," — Six mandatory gates and verdict format",{"type":45,"tag":65,"props":681,"children":682},{},[683,688],{"type":45,"tag":377,"props":684,"children":685},{"href":379},[686],{"type":51,"value":687},"Bug-Class Verification",{"type":51,"value":689}," — Class-specific verification requirements for memory corruption, logic bugs, race conditions, integer issues, crypto, injection, info disclosure, DoS, and deserialization",{"type":45,"tag":65,"props":691,"children":692},{},[693,699],{"type":45,"tag":377,"props":694,"children":696},{"href":695},"%7BbaseDir%7D\u002Freferences\u002Ffalse-positive-patterns.md",[697],{"type":51,"value":698},"False Positive Patterns",{"type":51,"value":700}," — 13-item checklist and red flags for common false positive patterns",{"type":45,"tag":65,"props":702,"children":703},{},[704,710],{"type":45,"tag":377,"props":705,"children":707},{"href":706},"%7BbaseDir%7D\u002Freferences\u002Fevidence-templates.md",[708],{"type":51,"value":709},"Evidence Templates",{"type":51,"value":711}," — Documentation templates for data flow, mathematical proofs, attacker control, and devil's advocate reviews",{"items":713,"total":863},[714,729,739,757,770,783,795,805,818,829,841,852],{"slug":715,"name":715,"fn":716,"description":717,"org":718,"tags":719,"stars":26,"repoUrl":27,"updatedAt":728},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[720,723,724,725],{"name":721,"slug":722,"type":16},"C#","c",{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":726,"slug":727,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":730,"name":730,"fn":731,"description":732,"org":733,"tags":734,"stars":26,"repoUrl":27,"updatedAt":738},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[735,736,737],{"name":721,"slug":722,"type":16},{"name":14,"slug":15,"type":16},{"name":726,"slug":727,"type":16},"2026-07-17T06:05:12.433192",{"slug":740,"name":740,"fn":741,"description":742,"org":743,"tags":744,"stars":26,"repoUrl":27,"updatedAt":756},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[745,748,751,752,755],{"name":746,"slug":747,"type":16},"Agents","agents",{"name":749,"slug":750,"type":16},"CI\u002FCD","ci-cd",{"name":21,"slug":22,"type":16},{"name":753,"slug":754,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":758,"name":758,"fn":759,"description":760,"org":761,"tags":762,"stars":26,"repoUrl":27,"updatedAt":769},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[763,764,765,766],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":767,"slug":768,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":771,"name":771,"fn":772,"description":773,"org":774,"tags":775,"stars":26,"repoUrl":27,"updatedAt":782},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[776,779],{"name":777,"slug":778,"type":16},"Engineering","engineering",{"name":780,"slug":781,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":784,"name":784,"fn":785,"description":786,"org":787,"tags":788,"stars":26,"repoUrl":27,"updatedAt":794},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[789,792,793],{"name":790,"slug":791,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":726,"slug":727,"type":16},"2026-07-17T06:05:14.575191",{"slug":796,"name":796,"fn":797,"description":798,"org":799,"tags":800,"stars":26,"repoUrl":27,"updatedAt":804},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[801,802,803],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":806,"name":806,"fn":807,"description":808,"org":809,"tags":810,"stars":26,"repoUrl":27,"updatedAt":817},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[811,814,815,816],{"name":812,"slug":813,"type":16},"Architecture","architecture",{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":777,"slug":778,"type":16},"2026-07-18T05:47:40.122449",{"slug":819,"name":819,"fn":820,"description":821,"org":822,"tags":823,"stars":26,"repoUrl":27,"updatedAt":828},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[824,825,826,827],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":777,"slug":778,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":830,"name":830,"fn":831,"description":832,"org":833,"tags":834,"stars":26,"repoUrl":27,"updatedAt":840},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[835,836,839],{"name":18,"slug":19,"type":16},{"name":837,"slug":838,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":842,"name":842,"fn":843,"description":844,"org":845,"tags":846,"stars":26,"repoUrl":27,"updatedAt":851},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[847,848,849,850],{"name":18,"slug":19,"type":16},{"name":721,"slug":722,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":853,"name":853,"fn":854,"description":855,"org":856,"tags":857,"stars":26,"repoUrl":27,"updatedAt":862},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[858,859,860,861],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":767,"slug":768,"type":16},"2026-07-18T05:47:42.84568",111,{"items":865,"total":911},[866,873,879,887,894,899,905],{"slug":715,"name":715,"fn":716,"description":717,"org":867,"tags":868,"stars":26,"repoUrl":27,"updatedAt":728},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[869,870,871,872],{"name":721,"slug":722,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":726,"slug":727,"type":16},{"slug":730,"name":730,"fn":731,"description":732,"org":874,"tags":875,"stars":26,"repoUrl":27,"updatedAt":738},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[876,877,878],{"name":721,"slug":722,"type":16},{"name":14,"slug":15,"type":16},{"name":726,"slug":727,"type":16},{"slug":740,"name":740,"fn":741,"description":742,"org":880,"tags":881,"stars":26,"repoUrl":27,"updatedAt":756},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[882,883,884,885,886],{"name":746,"slug":747,"type":16},{"name":749,"slug":750,"type":16},{"name":21,"slug":22,"type":16},{"name":753,"slug":754,"type":16},{"name":14,"slug":15,"type":16},{"slug":758,"name":758,"fn":759,"description":760,"org":888,"tags":889,"stars":26,"repoUrl":27,"updatedAt":769},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[890,891,892,893],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":767,"slug":768,"type":16},{"slug":771,"name":771,"fn":772,"description":773,"org":895,"tags":896,"stars":26,"repoUrl":27,"updatedAt":782},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[897,898],{"name":777,"slug":778,"type":16},{"name":780,"slug":781,"type":16},{"slug":784,"name":784,"fn":785,"description":786,"org":900,"tags":901,"stars":26,"repoUrl":27,"updatedAt":794},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[902,903,904],{"name":790,"slug":791,"type":16},{"name":14,"slug":15,"type":16},{"name":726,"slug":727,"type":16},{"slug":796,"name":796,"fn":797,"description":798,"org":906,"tags":907,"stars":26,"repoUrl":27,"updatedAt":804},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[908,909,910],{"name":18,"slug":19,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},77]