# Validate Vulnerability

> Validate a vulnerability claim in an authorized environment. Use for scanner candidates, advisories, CVEs, PoCs, source concerns, configuration weaknesses, or regressions with a safe proof and controls.

- Skill: `gaelic-ghost/validate-vulnerability` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/validate-vulnerability`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/validate-vulnerability/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/validate-vulnerability

---


# Validate Vulnerability

## Overview

Prove or refute the narrow claim with the least invasive reproduction. Separate vulnerable code or package presence from reachability, controllability, boundary crossing, and demonstrated impact.

Read [references/validation-evidence.md](references/validation-evidence.md) for proof levels and controls.

## Workflow

1. Confirm authorization and exact target/build/configuration.
2. State the hypothesis.
   - Define attacker position, controlled input, preconditions, code/endpoint, expected security property, and observable violation.
3. Establish controls.
   - Prepare a known-vulnerable or claimed build, fixed/patched or negative build, baseline input, and minimally changed trigger when practical.
4. Trace reachability.
   - Show how input reaches the affected component and whether authentication, feature flags, deployment topology, sanitization, mitigations, or dead code block it.
   - Use Codex Security for repository attack-path analysis when appropriate.
5. Reproduce minimally.
   - Prefer harmless markers, bounded data, synthetic accounts, and local fixtures.
   - Stop before destructive impact, persistence, unrelated data access, lateral movement, or instability beyond scope.
6. Capture evidence.
   - Record request/input, response/output, traces/logs, process or state change, exact tool/version, timestamps, cleanup, and retest.
7. Classify.
   - Validated exploitable, validated but constrained, vulnerable component present but not reachable, false positive for this target, fixed, or unresolved.

## Output

Return hypothesis, environment, controls, reachability, smallest safe proof, impact boundary, classification/confidence, cleanup, and remediation/retest criteria.