Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, o
Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, o
Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, o
Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, o
Sandbox only
Install targets
Codex install prompt
Install the "common-exploit-verification" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-exploit-verification. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-exploit-verification","task":"Install common-exploit-verification","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Maintenance
fresh
6d since push
Risk
Safe to try
Quality score needs review
GitHub quality
561
74/100 Quality · 81/100 Trust
Coverage tags
Review notes
Quality score needs review
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Safe to tryA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
6d since push
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
Agent should check
Copy prompt
Task: Use common-exploit-verification in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
LLM text format
/api/skills/hoangnguyen0403-common-exploit-verification/install?format=text
Find alternatives
/api/skills/search?q=common-exploit-verification&limit=3
Agent prompt
Use common-exploit-verification for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-exploit-verification
LLM text
/api/registry/manifest/hoangnguyen0403-common-exploit-verification?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-exploit-verification
Recommend
/api/registry/recommend?task=Use%20common-exploit-verification%20in%20an%20agent%20workflow&limit=3
Agent fit
Security and compliance
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Security and compliance
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASS6d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-exploit-verification description: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. metadata: triggers: keywords: - exploit verification - proof of concept - PoC - false positive - validate finding - exploit proof - pentest finding - security evidence --- # Exploit Verification Standard
## **Priority: P0 (CRITICAL)**
## Always-Apply Rules
- **No Exploit = No Report**: Finding without reproducible PoC is discarded. No exceptions. - **No Theoretical Findings**: "This could be exploited if..." → rejected. Demonstrate actual impact. - **No Tool Output as Evidence**: Scanner output alone insufficient. Manual verification required.
## PoC Construction
Every confirmed finding must include all fields:
``` ID: [unique identifier] Vulnerability: [CWE-XXX: type name] Platform: [backend|frontend|mobile-ios|mobile-android] Component: [file:line or endpoint] Severity: [Critical|High|Medium|Low] (CVSS: X.X) OWASP: [mapping — e.g., A03:2021, API1:2023, M4:2024]
-- Proof of Concept -- Preconditions: [required state, auth level, config] Steps: 1. [exact step with command/payload] 2. [expected vs actual result] Payload: [exact input — copy-paste ready] Evidence: [response body, status code, data returned]
-- Impact -- Impact: [what attacker gains — data, access, control] Blast Radius: [lateral movement, escalation paths]
-- Remediation -- Fix: [specific code change, not generic advice] ```
## Validation Gate
| Result | Action | Criteria | |---|---|---| | ✅ Confirmed | Include in report | PoC reproduces, impact demonstrated | | ⚠️ Conditional | Include with conditions | Requires specific config/timing/race | | ❌ Unconfirmed | **Discard** | Cannot reproduce despite 3 attempts | | 🔄 Degraded | Downgrade severity | Partial impact, mitigating controls exist |
## False Positive Filters
See [false-positive-checklist](references/false-positive-checklist.md) for platform-specific filters.
Quick checks before reporting: - **SAST-only finding**: Is the flagged code actually reachable from user input? Trace full data flow. - **Scanner noise**: Does the "vulnerability" have compensating controls (WAF, middleware, framework defaults)? - **Version mismatch**: Is the CVE for a function the project actually uses (reachability analysis)? - **Client-side only**: Is the "bypass" only client-side while server enforces correctly?
## Anti-Patterns
- **No severity inflation**: Missing header ≠ Critical. CVSS score must match demonstrated impact. - **No duplicate findings**: Same root cause across endpoints = 1 finding with multiple affected components. - **No remediation without specificity**: "Use parameterized queries" → include the exact code change for the affected file.
## References
- [False Positive Checklist](references/false-positive-checklist.md) — platform-specific false positive filters - [Exploit Playbook](references/exploit-playbook.md) — PoC templates per vulnerability class (backend, frontend, mobile)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-exploit-verification, ready for a manual X post.
common-exploit-verification: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filter... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x
Listing + install path for common-exploit-verification: https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verif...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "common-exploit-verification" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-exploit-verification. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-exploit-verification","task":"Install common-exploit-verification","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Maintenance
fresh
6d since push
Risk
Safe to try
Quality score needs review
GitHub quality
561
74/100 Quality · 81/100 Trust
Coverage tags
Review notes
Quality score needs review
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Safe to tryA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
6d since push
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
Agent should check
Copy prompt
Task: Use common-exploit-verification in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
LLM text format
/api/skills/hoangnguyen0403-common-exploit-verification/install?format=text
Find alternatives
/api/skills/search?q=common-exploit-verification&limit=3
Agent prompt
Use common-exploit-verification for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-exploit-verification
LLM text
/api/registry/manifest/hoangnguyen0403-common-exploit-verification?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-exploit-verification
Recommend
/api/registry/recommend?task=Use%20common-exploit-verification%20in%20an%20agent%20workflow&limit=3
Agent fit
Security and compliance
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Security and compliance
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASS6d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-exploit-verification description: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. metadata: triggers: keywords: - exploit verification - proof of concept - PoC - false positive - validate finding - exploit proof - pentest finding - security evidence --- # Exploit Verification Standard
## **Priority: P0 (CRITICAL)**
## Always-Apply Rules
- **No Exploit = No Report**: Finding without reproducible PoC is discarded. No exceptions. - **No Theoretical Findings**: "This could be exploited if..." → rejected. Demonstrate actual impact. - **No Tool Output as Evidence**: Scanner output alone insufficient. Manual verification required.
## PoC Construction
Every confirmed finding must include all fields:
``` ID: [unique identifier] Vulnerability: [CWE-XXX: type name] Platform: [backend|frontend|mobile-ios|mobile-android] Component: [file:line or endpoint] Severity: [Critical|High|Medium|Low] (CVSS: X.X) OWASP: [mapping — e.g., A03:2021, API1:2023, M4:2024]
-- Proof of Concept -- Preconditions: [required state, auth level, config] Steps: 1. [exact step with command/payload] 2. [expected vs actual result] Payload: [exact input — copy-paste ready] Evidence: [response body, status code, data returned]
-- Impact -- Impact: [what attacker gains — data, access, control] Blast Radius: [lateral movement, escalation paths]
-- Remediation -- Fix: [specific code change, not generic advice] ```
## Validation Gate
| Result | Action | Criteria | |---|---|---| | ✅ Confirmed | Include in report | PoC reproduces, impact demonstrated | | ⚠️ Conditional | Include with conditions | Requires specific config/timing/race | | ❌ Unconfirmed | **Discard** | Cannot reproduce despite 3 attempts | | 🔄 Degraded | Downgrade severity | Partial impact, mitigating controls exist |
## False Positive Filters
See [false-positive-checklist](references/false-positive-checklist.md) for platform-specific filters.
Quick checks before reporting: - **SAST-only finding**: Is the flagged code actually reachable from user input? Trace full data flow. - **Scanner noise**: Does the "vulnerability" have compensating controls (WAF, middleware, framework defaults)? - **Version mismatch**: Is the CVE for a function the project actually uses (reachability analysis)? - **Client-side only**: Is the "bypass" only client-side while server enforces correctly?
## Anti-Patterns
- **No severity inflation**: Missing header ≠ Critical. CVSS score must match demonstrated impact. - **No duplicate findings**: Same root cause across endpoints = 1 finding with multiple affected components. - **No remediation without specificity**: "Use parameterized queries" → include the exact code change for the affected file.
## References
- [False Positive Checklist](references/false-positive-checklist.md) — platform-specific false positive filters - [Exploit Playbook](references/exploit-playbook.md) — PoC templates per vulnerability class (backend, frontend, mobile)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-exploit-verification, ready for a manual X post.
common-exploit-verification: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filter... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x
Listing + install path for common-exploit-verification: https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verif...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "common-exploit-verification" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-exploit-verification. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-exploit-verification","task":"Install common-exploit-verification","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Maintenance
fresh
6d since push
Risk
Safe to try
Quality score needs review
GitHub quality
561
74/100 Quality · 81/100 Trust
Coverage tags
Review notes
Quality score needs review
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Safe to tryA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
6d since push
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
Agent should check
Copy prompt
Task: Use common-exploit-verification in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
LLM text format
/api/skills/hoangnguyen0403-common-exploit-verification/install?format=text
Find alternatives
/api/skills/search?q=common-exploit-verification&limit=3
Agent prompt
Use common-exploit-verification for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-exploit-verification
LLM text
/api/registry/manifest/hoangnguyen0403-common-exploit-verification?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-exploit-verification
Recommend
/api/registry/recommend?task=Use%20common-exploit-verification%20in%20an%20agent%20workflow&limit=3
Agent fit
Security and compliance
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Security and compliance
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASS6d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-exploit-verification description: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. metadata: triggers: keywords: - exploit verification - proof of concept - PoC - false positive - validate finding - exploit proof - pentest finding - security evidence --- # Exploit Verification Standard
## **Priority: P0 (CRITICAL)**
## Always-Apply Rules
- **No Exploit = No Report**: Finding without reproducible PoC is discarded. No exceptions. - **No Theoretical Findings**: "This could be exploited if..." → rejected. Demonstrate actual impact. - **No Tool Output as Evidence**: Scanner output alone insufficient. Manual verification required.
## PoC Construction
Every confirmed finding must include all fields:
``` ID: [unique identifier] Vulnerability: [CWE-XXX: type name] Platform: [backend|frontend|mobile-ios|mobile-android] Component: [file:line or endpoint] Severity: [Critical|High|Medium|Low] (CVSS: X.X) OWASP: [mapping — e.g., A03:2021, API1:2023, M4:2024]
-- Proof of Concept -- Preconditions: [required state, auth level, config] Steps: 1. [exact step with command/payload] 2. [expected vs actual result] Payload: [exact input — copy-paste ready] Evidence: [response body, status code, data returned]
-- Impact -- Impact: [what attacker gains — data, access, control] Blast Radius: [lateral movement, escalation paths]
-- Remediation -- Fix: [specific code change, not generic advice] ```
## Validation Gate
| Result | Action | Criteria | |---|---|---| | ✅ Confirmed | Include in report | PoC reproduces, impact demonstrated | | ⚠️ Conditional | Include with conditions | Requires specific config/timing/race | | ❌ Unconfirmed | **Discard** | Cannot reproduce despite 3 attempts | | 🔄 Degraded | Downgrade severity | Partial impact, mitigating controls exist |
## False Positive Filters
See [false-positive-checklist](references/false-positive-checklist.md) for platform-specific filters.
Quick checks before reporting: - **SAST-only finding**: Is the flagged code actually reachable from user input? Trace full data flow. - **Scanner noise**: Does the "vulnerability" have compensating controls (WAF, middleware, framework defaults)? - **Version mismatch**: Is the CVE for a function the project actually uses (reachability analysis)? - **Client-side only**: Is the "bypass" only client-side while server enforces correctly?
## Anti-Patterns
- **No severity inflation**: Missing header ≠ Critical. CVSS score must match demonstrated impact. - **No duplicate findings**: Same root cause across endpoints = 1 finding with multiple affected components. - **No remediation without specificity**: "Use parameterized queries" → include the exact code change for the affected file.
## References
- [False Positive Checklist](references/false-positive-checklist.md) — platform-specific false positive filters - [Exploit Playbook](references/exploit-playbook.md) — PoC templates per vulnerability class (backend, frontend, mobile)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-exploit-verification, ready for a manual X post.
common-exploit-verification: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filter... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x
Listing + install path for common-exploit-verification: https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verif...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "common-exploit-verification" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-exploit-verification. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-exploit-verification","task":"Install common-exploit-verification","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Maintenance
fresh
6d since push
Risk
Safe to try
Quality score needs review
GitHub quality
561
74/100 Quality · 81/100 Trust
Coverage tags
Review notes
Quality score needs review
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Safe to tryA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
6d since push
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
Agent should check
Copy prompt
Task: Use common-exploit-verification in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-exploit-verification%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verification
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-exploit-verification/install
LLM text format
/api/skills/hoangnguyen0403-common-exploit-verification/install?format=text
Find alternatives
/api/skills/search?q=common-exploit-verification&limit=3
Agent prompt
Use common-exploit-verification for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-exploit-verification/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verificationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-exploit-verification
LLM text
/api/registry/manifest/hoangnguyen0403-common-exploit-verification?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-exploit-verification
Recommend
/api/registry/recommend?task=Use%20common-exploit-verification%20in%20an%20agent%20workflow&limit=3
Agent fit
Security and compliance
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Security and compliance
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASS6d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-exploit-verification description: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filtering, and evidence collection per vulnerability class across backend, frontend, and mobile. Use when validating security findings, constructing exploit proofs, filtering false positives, or writing pentest findings. metadata: triggers: keywords: - exploit verification - proof of concept - PoC - false positive - validate finding - exploit proof - pentest finding - security evidence --- # Exploit Verification Standard
## **Priority: P0 (CRITICAL)**
## Always-Apply Rules
- **No Exploit = No Report**: Finding without reproducible PoC is discarded. No exceptions. - **No Theoretical Findings**: "This could be exploited if..." → rejected. Demonstrate actual impact. - **No Tool Output as Evidence**: Scanner output alone insufficient. Manual verification required.
## PoC Construction
Every confirmed finding must include all fields:
``` ID: [unique identifier] Vulnerability: [CWE-XXX: type name] Platform: [backend|frontend|mobile-ios|mobile-android] Component: [file:line or endpoint] Severity: [Critical|High|Medium|Low] (CVSS: X.X) OWASP: [mapping — e.g., A03:2021, API1:2023, M4:2024]
-- Proof of Concept -- Preconditions: [required state, auth level, config] Steps: 1. [exact step with command/payload] 2. [expected vs actual result] Payload: [exact input — copy-paste ready] Evidence: [response body, status code, data returned]
-- Impact -- Impact: [what attacker gains — data, access, control] Blast Radius: [lateral movement, escalation paths]
-- Remediation -- Fix: [specific code change, not generic advice] ```
## Validation Gate
| Result | Action | Criteria | |---|---|---| | ✅ Confirmed | Include in report | PoC reproduces, impact demonstrated | | ⚠️ Conditional | Include with conditions | Requires specific config/timing/race | | ❌ Unconfirmed | **Discard** | Cannot reproduce despite 3 attempts | | 🔄 Degraded | Downgrade severity | Partial impact, mitigating controls exist |
## False Positive Filters
See [false-positive-checklist](references/false-positive-checklist.md) for platform-specific filters.
Quick checks before reporting: - **SAST-only finding**: Is the flagged code actually reachable from user input? Trace full data flow. - **Scanner noise**: Does the "vulnerability" have compensating controls (WAF, middleware, framework defaults)? - **Version mismatch**: Is the CVE for a function the project actually uses (reachability analysis)? - **Client-side only**: Is the "bypass" only client-side while server enforces correctly?
## Anti-Patterns
- **No severity inflation**: Missing header ≠ Critical. CVSS score must match demonstrated impact. - **No duplicate findings**: Same root cause across endpoints = 1 finding with multiple affected components. - **No remediation without specificity**: "Use parameterized queries" → include the exact code change for the affected file.
## References
- [False Positive Checklist](references/false-positive-checklist.md) — platform-specific false positive filters - [Exploit Playbook](references/exploit-playbook.md) — PoC templates per vulnerability class (backend, frontend, mobile)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-exploit-verification, ready for a manual X post.
common-exploit-verification: Enforce "No Exploit, No Report" policy with PoC construction standards, false-positive filter... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x
Listing + install path for common-exploit-verification: https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-exploit-verif...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-exploit-verification?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsPermission surface
shell or command execution, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness
Permission surface
shell or command execution, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness
Permission surface
shell or command execution, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness
Permission surface
shell or command execution, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness