# Second Opinion

> 独立复核：对复杂或反直觉发现穷举替代解释、置信度评分(1-10)、给出补充验证步骤。触发词：第二意见、复核、太好了不像真的。fp-check 通过后对高影响发现使用。

- Skill: `wufufu770/second-opinion` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/second-opinion`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/second-opinion/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/second-opinion

---


## TL;DR

- **目的**：独立复核：对复杂或反直觉发现穷举替代解释、置信度评分(1-10)、给出补充验证步骤。
- **适用**：复杂/异常发现的复核
- **输入**：候选发现 + 证据链 + 假设
- **输出**：替代解释 + 验证步骤建议 + 置信度评分
- **红线**：保持独立判断，不带预设
- **关联**：上游：fp-check → 下游：reporting skill


## When to Use

- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology

## When NOT to Use

- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)
## Workflow

1. **State the finding** — What was found, with evidence
2. **List assumptions** — What conditions had to be true
3. **Brainstorm alternatives** — Other explanations for the evidence
4. **Verify each alternative** — Can it be ruled out? How?
5. **Score confidence** — 1-10 with reasoning
6. **Suggest additional tests** — To increase confidence

## Confidence Scoring

- **9-10**: Two independent tools, reproducible, clear impact
- **7-8**: One tool, manual confirmation, plausible impact
- **5-6**: One tool, no manual confirmation
- **3-4**: Edge case, depends on specific conditions
- **1-2**: Likely false positive

## Common False Positives

- **WAF response code** — 403 is block, not exploit success
- **Custom error page** — Looks like SQL error but is app-specific
- **Self-XSS** — Reporter's own input echoed back
- **Out-of-bounds test data** — Test endpoint only
- **CSRF on GET-only form** — No state change possible