Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Vulnerability Validation — measured AI agent skill | DecimalAI

codexstar69/vulnerability-validation

NewSkillScoreMaintained

Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.

Securityby codexstar69

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/codexstar69-vulnerability-validation/SKILL.md

decimalai skills pull codexstar69-vulnerability-validation --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/codexstar69-vulnerability-validation/SKILL.md https://app.decimal.ai/s/codexstar69-vulnerability-validation/SKILL.md

Raw file: /s/codexstar69-vulnerability-validation/SKILL.md ↗ · machine-readable summary at /s/codexstar69-vulnerability-validation.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 3h ago

Yes — +9% lift+0% tokens0% turns73% of whole cases pass with skill (16/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-13	✗→✓	▲ Improved	4%	0%
case-16	✗→✓	▲ Improved	77%	0%
case-19	✗→✓	▲ Improved	-14%	0%
case-11	✓→✗	▼ Worse	-1%	0%
case-04	✓→✓	＝ Same ✓	160%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

codexstar69 / bug-hunter

skills/vulnerability-validation/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v2

Skill contents

SKILL.md

Vulnerability Validation

This is a bundled local Bug Hunter companion skill. It strengthens the security-specific parts of the Skeptic/Referee process.

Purpose

Take suspected or confirmed security findings and answer:

Is the vulnerable path reachable?
Can an attacker control the input?
Are there existing mitigations?
How exploitable is it really?
What is the CVSS / PoC / impact level?

Inputs

Prefer Bug Hunter-native artifacts:

.bug-hunter/hunter-findings.json
.bug-hunter/threat-model.md
.bug-hunter/security-config.json
.bug-hunter/dep-findings.json when dependency issues are involved

Workflow

Read the findings and isolate the security ones.
Trace reachability:

EXTERNAL
AUTHENTICATED
INTERNAL
UNREACHABLE

Trace exploitability:

EASY
MEDIUM
HARD
NOT_EXPLOITABLE

Check for mitigations already present in code, framework behavior, or deployment assumptions.
For confirmed HIGH/CRITICAL security bugs, generate:

exploitation path
benign proof of concept
CVSS vector + score

Feed the result back into Bug Hunter-native verdicting.

Outputs

When used as a companion to the main pipeline, keep outputs compatible with:

.bug-hunter/referee.json
.bug-hunter/report.md

If a separate validation artifact is helpful for the run, place it under .bug-hunter/validated-findings.json.

Important constraints

This skill validates findings; it does not replace the normal fix pipeline.
Keep outputs portable and self-contained under .bug-hunter/.
Prefer explicit reasoning for false positives so the user can trust dismissals.

Want to see if codexstar69/vulnerability-validation would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.