# Vulnerability Analysis

> Analyzes scan results and code flaws, formulates security hypotheses, generates deterministic PoCs, and eliminates false positives following the "No PoC, No Finding" standard.

- Skill: `zyrexnn/vulnerability-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zyrexnn/vulnerability-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zyrexnn/vulnerability-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zyrexnn (https://skillmd.com/u/zyrexnn)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zyrexnn/vulnerability-analysis

---


# Vulnerability Analysis Skill — Autonomous Triaging & PoC Verification

## Purpose
Transform raw scan observations or code patterns into confirmed, high-impact security findings by executing a structured 5-stage verification lifecycle.

## 5-Stage Autonomous Testing Lifecycle

```text
┌─────────────────────────────────────────────────────────────┐
│ 1. Triaging & Signal Detection (Nuclei, SAST, Crawlers)     │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Root Cause Hypothesis & Knowledge Correlation            │
│    (Cross-reference HackTricks, PayloadsAllTheThings)        │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Target-Specific Exploit / Payload Construction           │
│    (Custom Python / cURL probe adjusted for target WAF/tech)│
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 4. Deterministic PoC Execution ("No PoC, No Finding")       │
│    (Execute & assert unambiguous response indicator)        │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│ 5. Impact Scoring (CVSS v3.1) & Remediation Drafting        │
└─────────────────────────────────────────────────────────────┘
```

## Workflow

### 1. Triage Observations
Extract candidate signals from Nuclei or manual probes:
```bash
jq -r '[.info.name, .info.severity, .matched_at, .template_id] | @tsv' /workspace/output/nuclei/<target>/*.json 2>/dev/null
```

### 2. Formulate Attack Hypothesis
Before firing payloads, define:
- **Root Cause**: What parameter, header, or logic flaw triggers the bug?
- **Expected Indicator**: What exact string, status code, delay, or OAST DNS callback proves exploitation?
- **Knowledge Search**:
  ```bash
  rg -i "<vulnerability_keyword>" /workspace/knowledge/ -g "*.md"
  ```

### 3. Build & Run Deterministic Verification
Execute a single, non-destructive probe to confirm exploitability:
- **SQLi**: Test boolean differentials or benign arithmetic (`1+1=2` vs `1+1=3`).
- **Command Injection**: Execute benign commands (`whoami`, `id`, `echo TEST_TOKEN`).
- **SSRF / Blind RCE**: Generate an OAST callback domain using `interactsh-client` and observe interaction.
- **Client-Side / DOM XSS**: Verify payload trigger inside Browser MCP.

### 4. False Positive Elimination Checklist
- Is the response status code `200` merely a generic error page?
- Is the reflected payload properly sanitized/encoded in the DOM?
- Is the behavior reproducible consistently across multiple requests?

### 5. Final Confirmation
Only findings passing all verification checks are passed to [`evidence-collection`](file:///home/ikhsan/Documents/hermes-bug-bounty/skills/evidence-collection/SKILL.md) and [`reporting`](file:///home/ikhsan/Documents/hermes-bug-bounty/skills/reporting/SKILL.md).