The Agent Skills Directory

Security Validation Workflow: The skill outlines procedures for validating potential vulnerabilities by attempting to reproduce them using tools like gdb, lldb, valgrind, and address sanitizers (ASan). While this involves executing commands and analyzing potentially vulnerable code, the skill explicitly instructs the agent to use non-interactive, bounded commands and maintain artifacts within designated paths.
Dynamic Execution and PoC Generation: The instructions direct the agent to generate Proof-of-Concept (PoC) files or targeted commands to exercise vulnerable code paths. This is a standard part of a security professional's workflow to confirm if a 'candidate finding' is a true positive. The skill includes specific guidance to build debug variants and test directly against the application/library.
Internal Repository Scans and Data Handling: For large-scale scans, the skill allows for the use of existing tests and deployment/config evidence. It includes a requirement to read false_positive_feedback.json but treats its contents as data rather than instructions, which is a defensive measure against prompt injection via feedback files.
Artifact Management: The skill follows strict path conventions for saving PoCs, logs, and validation reports, ensuring that the output of the validation phase is organized and traceable for later human review.

validation