Vulnerability Validation

Validate security findings by assessing whether they are actually exploitable in the context of this codebase. This skill filters false positives, confirms real vulnerabilities, and generates proof-of-concept exploits.

Adapted from Factory AI security-engineer plugin.

When to Use This Skill

• After flux-opencode-security-scan - Validate findings before blocking PRs
• HIGH/CRITICAL findings - Prioritize validation of severe findings
• Before patching - Confirm vulnerability is real before investing in fixes
• Security review - Deep-dive validation of specific findings

Prerequisites

• .flux/threat-model.md must exist (from flux-opencode-threat-model skill)
• .flux/security/security-findings.json must exist (from flux-opencode-security-scan skill)

Instructions