# Common Exploit Verification

Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive...

- Repository: https://github.com/HoangNguyen0403/agent-skills-standard (582 stars)
- Category: Design
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification -g -a claude-code -y`
Codex: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification -g -a codex -y`
Cursor: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification -g -a cursor -y`
Gemini CLI: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification -g -a gemini-cli -y`

## Description

Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Exploit Verification Standard

## **Priority: P0 (CRITICAL)**

## Always-Apply Rules

- **No Exploit = No Report**: Finding without reproducible PoC is discarded. No exceptions.
- **No Theoretical Findings**: "This could be exploited if..." → rejected. Demonstrate actual impact.
- **No Tool Output as Evidence**: Scanner output alone insufficient. Manual verification required.

## PoC Construction

Every confirmed finding must include all fields:

```
ID: [unique identifier]
Vulnerability: [CWE-XXX: type name]
Platform: [backend|frontend|mobile-ios|mobile-android]
Component: [file:line or endpoint]
Severity: [Critical|High|Medium|Low] (CVSS: X.X)
OWASP: [mapping, e.g., A03:2021, API1:2023, M4:2024]

-- Proof of Concept --
Preconditions: [required state, auth level, config]
Steps:
1. [exact step with command/payload]
2. [expected vs actual result]
Payload: [exact input, copy-paste ready]
Evidence: [response body, status code, data returned]

-- Impact --
Impact: [what attacker gains, data, access, control]
Blast Radius: [lateral movement, escalation paths]

-- Remediation --
Fix: [specific code change, not generic advice]
```

## Validation Gate

| Result | Action | Criteria |
|---|---|---|
| ✅ Confirmed | Include in report | PoC reproduces, impact demonstrated |
| ⚠️ Conditional | Include with conditions | Requires specific config/timing/race |
| ❌ Unconfirmed | **Discard** | Cannot reproduce despite 3 attempts |
| 🔄 Degraded | Downgrade severity | Partial impact, mitigating controls exist |

## False Positive Filters

See [false-positive-checklist](references/false-positive-checklist.md) for platform-specific filters.

The rest: https://github.com/HoangNguyen0403/agent-skills-standard/blob/HEAD/.agents/skills/common/common-exploit-verification/SKILL.md