agentmods.dev

verify-finding

verify-finding is a skill for Claude Code from allsmog/vuln-scout. It costs 18 tokens per session (263 once invoked), scanned A, original, MIT.

A procedure for checking one security finding and deciding whether it is a real, exploitable problem or a false alarm. It follows the path from the risky code to the affected operation and records the result.

In plain words
What is it for?
Use it for a named VSCOUT finding, a finding key, or a specific file and line that needs verification.
Why use it?
It prevents developers from treating every scan result as a confirmed vulnerability or dismissing a real issue without checking it.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the vuln-scout plugin — 32 skills, 15 commands, 9 agents shipped together

not rated 24repo 2mo ago A scan 18 tokens original MIT

Good fit Use it for a named VSCOUT finding, a finding key, or a specific file and line that needs verification.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/allsmog/vuln-scout/verify-finding
View source ↗ allsmog/vuln-scout
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add allsmog/vuln-scout --skill verify-finding
Clone the repo
git clone --depth 1 https://github.com/allsmog/vuln-scout

Made for: Claude Code.

Or install vuln-scout, the plugin that ships this one along with the rest of its 32 skills, 15 commands, 9 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for verify-finding

README.md
[![agentmods](https://agentmods.dev/badge/skills/allsmog/vuln-scout/verify-finding/github.svg)](https://agentmods.dev/skills/allsmog/vuln-scout/verify-finding)
Your own site
<a href="https://agentmods.dev/skills/allsmog/vuln-scout/verify-finding"><img src="https://agentmods.dev/badge/skills/allsmog/vuln-scout/verify-finding/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for verify-finding

Your own site · 80×15
<a href="https://agentmods.dev/skills/allsmog/vuln-scout/verify-finding"><img src="https://agentmods.dev/badge/skills/allsmog/vuln-scout/verify-finding.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 18 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 263 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00018 $0.00263
Opus 5 $0.00009 $0.00131
Sonnet 5 $0.00004 $0.00053
Haiku 4.5 $0.00002 $0.00026

Measured 9d ago against content hash e49be4011dc1, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

verify-finding scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

vuln-scout/skills/tasks/verify-finding/SKILL.md · 28 lines

What it actually says

Verify Finding

Use this task skill when the user asks to verify VSCOUT-*, asks whether a finding is exploitable, or asks to confirm a specific finding.

Workflow

  1. Locate the finding by ID, stable key, or file:line in .claude/findings.json.
  2. Run /vuln-scout:trace on the source-to-sink path.
  3. Run /vuln-scout:verify for CPG-backed confirmation.
  4. Call false-positive-verifier when controls, sanitizers, or reachability are unclear.
  5. Call local-tester only when dynamic validation is explicitly safe and useful.
  6. Run /vuln-scout:propagate when a confirmed pattern may repeat.
  7. Update .claude/review-ledger.json with the final verification state.

Produces

  • Updated .claude/review-ledger.json entry
  • optional trace artifact

When NOT To Trigger

Do not trigger for broad scans, PR review, generic exploitability education, dangerous-function lists, or CPG query syntax questions that do not name a finding.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 28 lines · 18 tokens per session scan A e49be4011dc1

Subscribe to this mod's changes

verify-finding is a skill published in the GitHub repository allsmog/vuln-scout (24 stars, last pushed 2mo ago), licensed MIT. It adds 18 tokens to every session and 263 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude CodeSecurityappsecclaude-code-pluginsastsemgrepthreat-modeling
Related

Other skills, from other repositories

sast-config

Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI…

UnitOneAI/SecuritySkills · 78 tokens

sast-semgrep

Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based…

AgentSecOps/SecOpsAgentKit · 116 tokens

sast-semgrep

Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based…

rohunj/claude-build-workflow · 116 tokens

implementing-devsecops-security-scanning

Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for…

xalgorix/xalgorix · 109 tokens

integrating-sast-into-github-actions-pipeline

This skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and…

xalgorix/xalgorix · 84 tokens

implementing-semgrep-for-custom-sast-rules

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.

xalgorix/xalgorix · 37 tokens