SECURITY REVIEW / Trail of Bits
Exploitability verifier
Pins the fp-check phase-2 agent that stays read-only while deciding whether a suspected bug is exploitable, and that skips a proof the bug class does not need.
“Read-only check of whether a reported bug is exploitable, without assuming control or applying a bounds or race proof to the wrong class.”
01 / THE REASONING
Why this made the selection.
- The agents catalogue has no sourcePath for plugins/fp-check/agents/exploitability-verifier.md.
- The file says the agent is read-only, refuses to assume attacker control, and skips the bounds or race sub-phase when that bug class does not apply.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/fp-check/agents/exploitability-verifier.md
- plugins/fp-check/README.md
- README.md
- LICENSE
Our findings
- The body says the agent is read-only. The tool list is Read, Grep, and Glob.
- It says never to assume attacker control without tracing who can supply the data, including data that only a privileged component writes.
- It says to skip the bounds sub-phase when the issue is not a bounds issue, and to skip the race sub-phase when the issue is not a concurrency issue.
- It says to separate mathematically impossible, practically infeasible, and feasible, and the conclusion is exploitable or not exploitable with a reason.
Not established by this review
- The resource was not executed and its tools were not called.
- No phase-1 analysis was supplied.
- No triggering value or attack scenario was produced.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Use the role in your project.
DOCUMENTED COMMAND
/plugin install fp-checkCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The fp-check README prints that line with no leading spaces under Installation.
- That line installs the fp-check plugin. It does not name this agent.
- The repository README's marketplace line adds the marketplace, not this agent, so it is not install.command.
Before you start
- Claude Code or Codex marketplace support, which the repository README states
- The fp-check dispatch that spawns this agent
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- exploitability-verifier ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/fp-check/agents/exploitability-verifier.md
Supports: read-only rule, no assumed control, and skipped inapplicable proofs
- Repository root LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Attribution-ShareAlike 4.0 International
- fp-check README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/fp-check/README.md
Supports: plugin install line and phase-2 description of this agent
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: CC-BY-SA-4.0 statement and marketplace install line