SECURITY REVIEW / Trail of Bits
False Positive Check
Forces a true-positive or false-positive verdict on one suspected bug, and refuses to be used as a bug hunter.
“Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.”
01 / THE REASONING
Why this made the selection.
- The definition separates verification of a named finding from hunting for new bugs, and lists the phrases that should not trigger it.
- A verdict requires documented evidence rather than a confidence adjective.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/fp-check/skills/fp-check/SKILL.md
- README.md
- LICENSE
Our findings
- When NOT to Use explicitly excludes "find bugs" and "audit code".
- allowed-tools includes Read, Grep, Glob, LSP, Bash and Task.
- The definition separates standard and deep review and requires root cause, trigger and impact checks plus cross-finding exploit-chain consideration.
- Standard verification is the default and applies only when the claim is specific, single-component, a known bug class, non-concurrent, and a straight source-to-sink flow.
Not established by this review
- The skill was not executed inside a host agent.
- No bundled script, if present, was run against a real project.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- In Claude Code, add the upstream marketplace, then use /plugin menu to select the fp-check plugin. Adding a marketplace alone does not install a plugin.
- The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow.
- Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task.
Before you start
- A concrete finding, authorized local test scope, and the complete fp-check plugin with its references and analysis agents.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/fp-check/skills/fp-check/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: Redistribution terms
- Install instructions ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md
Supports: Documented install command