# fp-check

Walks a suspected vulnerability through verification and returns a TRUE POSITIVE or FALSE POSITIVE verdict backed by evidence. Built for confirming findings, not hunting new ones.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 7000 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/fp-check/skills/fp-check/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/fp-check

## What it does

The skill takes one suspected bug and verifies it end to end. Step 0 restates the claim in plain words: the exact vulnerability, its alleged root cause, the trigger, the claimed impact, and the threat model. Many false positives die right there, because a precise restatement often stops making sense.

Then it picks a route. Standard verification is a linear checklist for simple cases: one component, a familiar bug class, no concurrency. Deep verification covers data paths that cross several modules, race conditions and TOCTOU, or logic bugs with no spec to check against. Standard has escalation points that hand off to deep. Supporting material lives in `references/standard-verification.md`, `references/deep-verification.md`, `references/gate-reviews.md` with six mandatory gates, `references/bug-class-verification.md` for class-specific requirements, and `references/evidence-templates.md` for write-ups.

Hunting bugs is out of scope, and so is style or performance review. The skill needs code-reading and command tools — `allowed-tools` lists `Read`, `Grep`, `Glob`, `LSP`, `Bash`, `Task`, `Write`, `Edit`, `AskUserQuestion` and the task tools. With several findings, it runs Step 0 across all of them first, verifies each one on its own route, then looks for exploit chains among findings that failed gate review individually.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill fp-check -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/fp-check/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/fp-check/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill fp-check -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/fp-check/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill fp-check -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/fp-check/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills fp-check
```

2. **Manually: put the files in place**
- File: `.github/skills/fp-check/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill fp-check -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/fp-check/skills/fp-check
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/fp-check/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill fp-check -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/fp-check/skills/fp-check/SKILL.md

## When to use it
- clear false positives before a report goes to the client
- confirm whether a finding is actually exploitable
- work through a disputed bug claim with documented evidence
- verify a batch of findings and get a verdict per item
- spot exploit chains among findings that failed on their own

## Example prompts
- Verify this finding: heap overflow in `parse_header()` when `content_length` exceeds 4096 — true positive?
- Here are the suspicions from the audit, run fp-check on each and tell me which are false positives
- Check whether this vulnerability is exploitable and back the verdict with evidence

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md