fp-check — Claude Code skill: verify findings, kill false positives
Walks a suspected vulnerability through verification and returns a TRUE POSITIVE or FALSE POSITIVE verdict backed by evidence. Built for confirming findings, not hunting new ones.
npx skills add trailofbits/skills --skill fp-check -a claude-codeWhat fp-check does
The skill takes one suspected bug and verifies it end to end. Step 0 restates the claim in plain words: the exact vulnerability, its alleged root cause, the trigger, the claimed impact, and the threat model. Many false positives die right there, because a precise restatement often stops making sense.
Then it picks a route. Standard verification is a linear checklist for simple cases: one component, a familiar bug class, no concurrency. Deep verification covers data paths that cross several modules, race conditions and TOCTOU, or logic bugs with no spec to check against. Standard has escalation points that hand off to deep. Supporting material lives in references/standard-verification.md, references/deep-verification.md, references/gate-reviews.md with six mandatory gates, references/bug-class-verification.md for class-specific requirements, and references/evidence-templates.md for write-ups.
Hunting bugs is out of scope, and so is style or performance review. The skill needs code-reading and command tools — allowed-tools lists Read, Grep, Glob, LSP, Bash, Task, Write, Edit, AskUserQuestion and the task tools. With several findings, it runs Step 0 across all of them first, verifies each one on its own route, then looks for exploit chains among findings that failed gate review individually.
What it helps with
- clear false positives before a report goes to the client
- confirm whether a finding is actually exploitable
- work through a disputed bug claim with documented evidence
- verify a batch of findings and get a verdict per item
- spot exploit chains among findings that failed on their own
Example prompts for the agent
- Verify this finding: heap overflow in
parse_header()whencontent_lengthexceeds 4096 — true positive? - Here are the suspicions from the audit, run fp-check on each and tell me which are false positives
- Check whether this vulnerability is exploitable and back the verdict with evidence
How to install fp-check
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill fp-check -a claude-code2Manually: put the files in place
~/.claude/skills/fp-check/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/fp-check/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill fp-check -a codex2Manually: put the files in place
.agents/skills/fp-check/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill fp-check -a cursor2Manually: put the files in place
.cursor/skills/fp-check/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills fp-check2Manually: put the files in place
.github/skills/fp-check/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill fp-check -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/fp-check/skills/fp-checkManually: put the files in place
.devin/skills/fp-check/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill fp-check -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about fp-check
How do I install fp-check in Claude Code?
Run npx skills add trailofbits/skills --skill fp-check -a claude-code. The skill lands in ~/.claude/skills/fp-check/SKILL.md.
What does fp-check do?
It verifies a specific vulnerability claim and returns a TRUE POSITIVE or FALSE POSITIVE verdict with supporting evidence. Each finding goes through the phases rather than being judged by how the code looks.
Does fp-check find new bugs?
No. It verifies suspicions you already have. Bug hunting, code audits, and style or performance review are outside its scope.
