sc-verifier

SC: Verifier — False Positive Elimination & Confidence Scoring

Purpose

The verifier skill processes all raw findings from Phase 2 vulnerability skills, eliminates false positives through multi-criteria analysis, assigns confidence scores, merges duplicate findings, and produces a curated list of verified security issues. This is the quality gate that ensures the final report contains actionable, high-signal findings.

Activation

Runs in Phase 3 of the pipeline, after all Phase 2 vulnerability skills have completed.

Input

All files matching security-report/*-results.md

Output

File: security-report/verified-findings.md

Verification Process

Step 1: Finding Collection

1. Read all *-results.md files from security-report/
2. Parse each finding into a structured format (title, severity, confidence, file, line, type, description)
3. Skip files containing "No issues found"
4. Create a unified finding list with source skill attribution

Step 2: Reachability Analysis

For each finding, determine if the vulnerable code is actually reachable:

Check if code is in an executable path:

• Is the file imported/included by any other file?
• Is the function called from an entry point (HTTP handler, CLI command, etc.)?
• Is the file part of the build output (not excluded by build config)?
• Trace the call chain from entry point to vulnerable code

Reachability scoring:

• Directly reachable from HTTP handler: +30 confidence
• Reachable through 1-2 function calls: +20 confidence
• Reachable through 3+ function calls: +10 confidence
• No clear call path found: -20 confidence
• Dead code (no imports/calls): -40 confidence

Step 3: Sanitization Check

For each finding involving user input, check if input is sanitized:

Sanitization indicators:

• Input passes through validation library (Zod, Joi, Pydantic, Bean Validation)
• Input is parameterized (prepared statements, ORM methods)
• Input passes through encoding/escaping function (htmlspecialchars, html/template, DOMPurify)
• Input is type-cast to safe type (parseInt, strconv.Atoi)