fp-check
Systematically verify suspected security bugs and classify them as true or false positives with documented evidence.
- Guides you through structured claim analysis, data flow tracing, and gate reviews to eliminate false positives before reporting
- Supports two verification routes: standard (single-pass checklist for straightforward bugs) and deep (full task orchestration for complex, cross-component, or concurrent bugs)
- Includes built-in escalation checkpoints, bug-class-specific verification requirements, and a 13-item false positive pattern checklist to catch common misclassifications
- Produces final verdicts with counts, vulnerability descriptions, and rejection reasons for each bug analyzed
False Positive Check
When to Use
- "Is this bug real?" or "is this a true positive?"
- "Is this a false positive?" or "verify this finding"
- "Check if this vulnerability is exploitable"
- Any request to verify or validate a specific suspected bug
When NOT to Use
- Finding or hunting for bugs ("find bugs", "security analysis", "audit code")
- General code review for style, performance, or maintainability
- Feature development, refactoring, or non-security tasks
- When the user explicitly asks for a quick scan without verification
Rationalizations to Reject
If you catch yourself thinking any of these, STOP.
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K