Agent Native

vulnerability-validation

This skill validates security findings from commit-security-scan by tracing code reachability, analyzing data flow, assessing exploitability, and generating…

by FactoryOfficial publisherNot reviewed

Identity proven by GitHub's verified organisation badge (Factory-AI)

Agents
Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode
License
No license stated
Pin
7166a07pinned Oct 9, 2026
Context cost
about 2,600 tokenswhen the skill loads
GitHub stars
110on factory-ai/factory-plugins
Scripts
None found

What it does

“Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use after running commit-security-scan to confirm vulnerabilities.”
The author's description, from SKILL.md

Generated summary from the skill's own text

This skill validates security findings from commit-security-scan by tracing code reachability, analyzing data flow, assessing exploitability, and generating proof-of-concept exploits. It filters false positives, confirms real vulnerabilities with CVSS scoring, and produces a detailed validated-findings.json report for prioritization.

When to use it

  • After running commit-security-scan to confirm vulnerabilities before action
  • Validating HIGH or CRITICAL severity findings for prioritization
  • Before investing development effort in security patches
  • Deep-dive security reviews of specific flagged vulnerabilities

When not to

  • Without upstream security-findings.json from commit-security-scan
  • As initial vulnerability discovery tool instead of follow-up analysis
  • When threat-model.md from threat-model-generation skill is unavailable

Install

No license stated: install from the publisher's repository, and ask the author before you reuse or share it.

These commands install from the publisher's repository and need no account.

skills CLI

npx skills add factory-ai/factory-plugins --skill vulnerability-validation

Installs from the repository's default branch, which may have changed since the commit we checked.

GitHub CLI 2.90 or later

gh skill install factory-ai/factory-plugins vulnerability-validation@7166a0799e3dd39184068160b9caaa1e6469028a

Installs the commit we checked (7166a07).

Copy by hand

Download the folder at 7166a07 and put it in .claude/skills/vulnerability-validation for Claude Code and in .agents/skills/vulnerability-validation for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode.

Skill folder on GitHub at 7166a07

Copy for your agent

A prompt for any coding agent. It installs this skill from GitHub at the pinned commit, copies the files as they are, and runs nothing unless you ask.

Prompt

Install the agent skill "vulnerability-validation" by Factory.

Source, pinned to commit 7166a0799e3dd39184068160b9caaa1e6469028a:
https://github.com/factory-ai/factory-plugins/tree/7166a0799e3dd39184068160b9caaa1e6469028a/plugins/security-engineer/skills/vulnerability-validation

1. Download that folder at exactly this commit. Do not use the default branch.
2. Copy every file unchanged, keeping the folder structure, into .claude/skills/vulnerability-validation/ for Claude Code and .agents/skills/vulnerability-validation/ for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode. Create the folders if they do not exist.
3. Do not edit the files, and do not run any script in the folder unless I ask you to.
4. When you are done, list the files you copied and where you put them.

Its license is restricted or not stated. Show me the license terms from the repository before you copy anything.

Listing and checks: https://www.agentnative.dev/skills/factory/vulnerability-validation-factory-plugins

SKILL.md at the pin

The license of this skill does not let us show its files here.

View SKILL.md on GitHub at 7166a07

Files

2 files, 25 KB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.

Skill folder on GitHub at 7166a07
All 34 skills from Factory

More from Factory

  • autoresearch

    This skill runs an autonomous optimization loop to improve a measurable metric through systematic experimentation.

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 4K tokens · pinned 6 days ago

  • ban-type-assertions

    This skill enables the TypeScript ESLint rule that bans `as` type assertions in a package, replacing them with compiler-verified alternatives like Zod…

    Claude Code, Codex, Cursor +4 · about 1.6K tokens · pinned 6 days ago

  • browser-navigation

    This skill enables agents to automate browser interactions including navigation, form filling, element clicking, screenshots, and data extraction from web…

    Claude Code, Codex, Cursor +3 · about 2.5K tokens · pinned 6 days ago

  • create-pr

    Creates a pull request with Conventional Commits formatting, templated body, and optional ticket linking.

    Claude Code, Codex, Cursor +4 · about 2.2K tokens · pinned 6 days ago

  • droid-control

    Automate terminals, browsers, and desktop applications by routing to specialized drivers for recording, testing, and generating visual demonstrations.

    Claude Code · about 3.5K tokens · pinned 6 days ago

  • fix-knip-unused-exports

    Fixes knip unused export violations by identifying their type (test-only, dead barrel re-export, or internally-only-used) and applying the appropriate fix…

    Claude Code, Codex, Cursor +4 · about 2.4K tokens · pinned 6 days ago

All Security skills

Related in Security

  • claude-security

    Scans your repository for security issues using Claude, examines code changes or commits for vulnerabilities, and generates patch files to fix findings.

    by AnthropicOfficial publisher

    Claude Code · about 1K tokens · pinned 6 days ago

  • sensitive-logging-audit

    The skill helps audit and fix sensitive data leaks in Python SDK logging, exceptions, and telemetry by collecting candidate sinks, manually tracing values…

    by OpenAIOfficial publisher

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 970 tokens · pinned 6 days ago

  • security-audit

    This skill guides security audits of codebases, APIs, and services by finding vulnerabilities that cross real trust boundaries.

    by CloudflareOfficial publisher

    Contains scripts

    Claude Code · about 5.4K tokens · pinned 6 days ago

  • assess-patch-risk

    This skill analyzes patch artifacts to assess their program impact, regression risk, and suitability for automated merging.

    by OpenAIOfficial publisher

    Codex · about 2.3K tokens · pinned 6 days ago

  • attack-path-analysis

    This skill analyzes security findings to build explicit attack paths from source to sink, calibrates severity, and decides whether each finding is reportable.

    by OpenAIOfficial publisher

    Codex · about 2.1K tokens · pinned 6 days ago

  • deep-security-scan

    Performs exhaustive, multi-pass security analysis across a repository or scoped directory by running repeated independent security scans and aggregating…

    by OpenAIOfficial publisher

    Codex · about 3.4K tokens · pinned 6 days ago

Open roles at Factory

5 of 7 open roles on the jobs board

See all 7 roles at Factory on the jobs board

The skills listed here are third-party software, collected from public GitHub repositories as a catalog of recent skills and provided as is. Agent Native does not write or control them and is not responsible for any harm, loss or damage caused by installing or using them. Labels and checks describe what we saw at one commit and are not a guarantee. Read a skill's files before you run it. Terms of use