Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →shadd0wtaka/zen-risk-engine-skill
How the false positive reduction and risk scoring system works.
Passed 19 of 22 test cases with the skill, and 5 of 22 without it.
and 19 more in the full report
14 fixed5 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
When executing the MCP agent CLI command for vulnerability analysis, what key must be used in the data JSON payload to pass raw scanner results?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies tool_outputs as the top-level data JSON key | Missed | Passed |
The instructions your model reads when the skill loads.
How the false positive reduction and risk scoring system works.
from risk_engine.false_positive_engine import (
FalsePositiveEngine,
Vulnerability,
ScanContext,
)
engine = FalsePositiveEngine()
# Assess a finding
finding = {
"vuln_type": "reflected_xss",
"param": "search",
"url": "https://example.com/search?q=<script>alert(1)</script>",
"technique": "polyglot",
"confidence": 0.9,
}
result = engine.assess_finding(
finding,
ScanContext(
target_domain="example.com",
scan_phase="vulnerability_scan",
tool_source="nuclei",
),
)
print(f"FP probability: {result.fp_probability}") # 0.0–1.0
print(f"Decision: {result.decision}") # TRUE_POSITIVE | FALSE_POSITIVE | INDETERMINATE
The engine uses a multi-model voting system:
test cases passed, vs 5 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.