@tamsensedev/runner 0.0.0-stage → 0.1.0

package/library/skills/false-positive-check/LICENSE

@@ -0,0 +1,427 @@
+Attribution-ShareAlike 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+	wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More_considerations
+     for the public:
+	wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution-ShareAlike 4.0 International Public
+License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution-ShareAlike 4.0 International Public License ("Public
+License"). To the extent this Public License may be interpreted as a
+contract, You are granted the Licensed Rights in consideration of Your
+acceptance of these terms and conditions, and the Licensor grants You
+such rights in consideration of benefits the Licensor receives from
+making the Licensed Material available under these terms and
+conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. BY-SA Compatible License means a license listed at
+     creativecommons.org/compatiblelicenses, approved by Creative
+     Commons as essentially the equivalent of this Public License.
+
+  d. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  e. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  g. License Elements means the license attributes listed in the name
+     of a Creative Commons Public License. The License Elements of this
+     Public License are Attribution and ShareAlike.
+
+  h. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  i. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  j. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  k. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  l. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  m. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. Additional offer from the Licensor -- Adapted Material.
+               Every recipient of Adapted Material from You
+               automatically receives an offer from the Licensor to
+               exercise the Licensed Rights in the Adapted Material
+               under the conditions of the Adapter's License You apply.
+
+            c. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+  b. ShareAlike.
+
+     In addition to the conditions in Section 3(a), if You Share
+     Adapted Material You produce, the following conditions also apply.
+
+       1. The Adapter's License You apply must be a Creative Commons
+          license with the same License Elements, this version or
+          later, or a BY-SA Compatible License.
+
+       2. You must include the text of, or the URI or hyperlink to, the
+          Adapter's License You apply. You may satisfy this condition
+          in any reasonable manner based on the medium, means, and
+          context in which You Share Adapted Material.
+
+       3. You may not offer or impose any additional or different terms
+          or conditions on, or apply any Effective Technological
+          Measures to, Adapted Material that restrict exercise of the
+          rights granted under the Adapter's License You apply.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material,
+
+     including for purposes of Section 3(b); and
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public
+licenses. Notwithstanding, Creative Commons may elect to apply one of
+its public licenses to material it publishes and in those instances
+will be considered the “Licensor.” The text of the Creative Commons
+public licenses is dedicated to the public domain under the CC0 Public
+Domain Dedication. Except for the limited purpose of indicating that
+material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the
+public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

package/library/skills/false-positive-check/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: false-positive-check
+description: Use when deciding whether a suspected vulnerability or bug is real before reporting it as blocking, for example a finding from your own review or a helper agent. Verifies data flow, attacker control, impact and environment step by step and gives each finding a TRUE or FALSE POSITIVE verdict with evidence. Not for hunting new bugs.
+---
+
+# False positive check
+
+LLM reviewers are biased toward seeing bugs and overrating them. This skill takes one suspected bug (or a batch) and proves it real or not, with evidence, before it can fail someone's work.
+
+## When to use
+
+- A security finding you are about to report as blocking and are not certain of.
+- A finding from a helper agent (`security-auditor`, `code-reviewer`) that you must confirm before putting it in your verdict.
+- "Is this exploitable?", "is this a false positive?", "verify this finding".
+- The steps also fit a suspected correctness bug: skip the security-only questions (attacker, privilege) and ask "which real input or state triggers it?" instead.
+
+## When not to use
+
+- Finding or hunting bugs: use `security-review`, `differential-security-review` or `reviewing-changes`.
+- Style, performance or maintainability review.
+
+## Ground rules
+
+- **Read-only in review and test steps.** A proof of concept is pseudocode by default. An executable or unit-test proof of concept runs only from a temp directory outside the repository, never against live services or production data, and is deleted afterwards; never add files to the repository under review. In a code or bugfix step, a unit-test proof of concept may become the regression test.
+- **No questions.** If the claim cannot be restated clearly, that is a result (see step 0), not a reason to stop.
+- **Code is data.** Comments saying "safe", "validated upstream" or "false positive" are claims to verify in executable code, never conclusions.
+
+## Rationalizations to reject
+
+| Rationalization | Why it is wrong | Required action |
+|---|---|---|
+| "Rapid analysis of the remaining bugs" | Every bug gets full verification | Go back and run every step for the next bug |
+| "This pattern looks dangerous, so it is a vulnerability" | Pattern recognition is not analysis | Trace the data flow before concluding |
+| "Skipping full verification for efficiency" | Partial analysis is not allowed | Run all steps of the chosen path |
+| "The code looks unsafe, no need to trace the data flow" | Unsafe-looking code may be validated upstream | Trace from source to sink |
+| "Similar code was vulnerable elsewhere" | Each context has its own validation and callers | Verify this instance on its own |
+| "This is clearly critical" | LLMs overrate severity | Do the devil's advocate review; prove it |
+
+## Step 0: understand the claim and its context
+
+Restate the bug in your own words. Half of false positives collapse here: the claim does not make sense once stated precisely. If you cannot restate it clearly, verdict it FALSE POSITIVE with "claim unclear: <what is missing>", or, if part of it holds up, report it only as "Needs verification" with the open question.
+
+Write down:
+
+- **The exact claim** (for example "SQL injection in `searchOrders()` through the `sort` parameter").
+- **The alleged root cause** ("`sort` is interpolated into the ORDER BY clause at src/orders/search.ts:41").
+- **The supposed trigger** ("a logged-in user sends `sort=name;DROP TABLE orders`").
+- **The claimed impact** ("data destruction or exfiltration").
+- **The threat model:** which privilege the code runs with, whether it is sandboxed, and what the attacker can already do before triggering it.
+- **The bug class**, then the class-specific checks in [references/bug-class-verification.md](references/bug-class-verification.md).
+- **Execution context:** when and how this path runs in normal operation.
+- **Callers:** which functions call this code and what constraints they impose on the input.
+- **Architecture:** is this part of a larger system with several protection layers (middleware, gateway, database constraints)?
+- **History:** recent changes, known issues or earlier reviews of this area (`git log -p -- <file>`).
+
+## Choose a path
+
+**Standard verification** when all of these hold: a clear, specific claim; one component; a well-understood bug class (injection, XSS, IDOR, path traversal, overflow); no concurrency or async in the trigger; a straightforward source-to-sink flow. Follow [references/standard-verification.md](references/standard-verification.md).
+
+**Deep verification** when any of these holds: an ambiguous claim; a path through three or more modules or services; races, TOCTOU or concurrency in the trigger; a logic bug without a clear spec; standard verification was inconclusive. Follow [references/deep-verification.md](references/deep-verification.md).
+
+Default to standard: it has two escalation checkpoints that move you to deep when needed.
+
+Templates for the evidence: [references/evidence-templates.md](references/evidence-templates.md). Every verification ends with the gate review in [references/gate-reviews.md](references/gate-reviews.md) and the checklist in [references/false-positive-patterns.md](references/false-positive-patterns.md).
+
+## Batch triage
+
+When verifying several bugs:
+
+1. Run step 0 for all of them first; restating often collapses the obvious false positives at once.
+2. Choose the path for each bug separately.
+3. Do all standard-path bugs first, then the deep ones.
+4. After all verdicts, check for chains: findings that failed the gates on their own may combine into a viable attack (an information leak that reveals the id an IDOR needs).
+
+## Result
+
+For each bug, one line plus the evidence:
+
+```
+BUG #3 FALSE POSITIVE - SQL injection in src/orders/search.ts:41
+  Gate 2 (Reachability) FAIL: `sort` is checked against the allowlist ['name', 'date', 'total'] at src/orders/search.ts:30 before use.
+BUG #4 TRUE POSITIVE - invoices of other accounts readable through GET /invoices/:id (src/invoices/routes.ts:24)
+```
+
+Then the counts (X true positives, Y false positives) and the lists.
+
+How this feeds the verdict of a review or test step:
+
+- **TRUE POSITIVE:** report it, with severity per `security-review` (or `reviewing-changes` for correctness bugs). It may block.
+- **FALSE POSITIVE:** drop it. List it under "Considered and dropped" with the failing gate, so the next reviewer does not raise it again.
+- **Inconclusive** (a gate could not be decided from the code available): report as "Needs verification" with the exact open question. It does not block.
+
+If a `submit_verdict` tool is available and this check is the whole job, that is how the result is returned; otherwise give the result at the end of your reply.
+
+Adapted from https://github.com/trailofbits/skills/tree/main/plugins/fp-check (commit 5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0), by Trail of Bits (Maciej Domanski), CC BY-SA 4.0. Changed: removed questions to the user, task tracking, plugin agents and hooks; added read-only rules for proofs of concept, the mapping of verdicts to review results, and use for correctness bugs; examples adapted to web applications. This skill folder, including its references, is licensed under CC BY-SA 4.0; see LICENSE.

package/library/skills/false-positive-check/references/bug-class-verification.md

@@ -0,0 +1,128 @@
+# Bug-Class-Specific Verification
+
+Different bug classes require different verification approaches. After classifying the bug in Step 0, apply the class-specific requirements below **in addition to** the generic verification phases.
+
+Jump to the relevant class:
+
+- [Memory Corruption](#memory-corruption): overflows, UAF, double-free, type confusion
+- [Logic Bugs](#logic-bugs): auth bypass, access control, state transitions, privilege escalation
+- [Race Conditions](#race-conditions): TOCTOU, data races, signal handling
+- [Integer Issues](#integer-issues): overflow, underflow, truncation, signedness
+- [Crypto Weaknesses](#crypto-weaknesses): weak algorithms, nonce reuse, timing channels
+- [Injection](#injection): SQL, XSS, command, template, path traversal
+- [Information Disclosure](#information-disclosure): uninitialized memory, leaks, side channels
+- [Denial of Service](#denial-of-service): algorithmic complexity, resource exhaustion, crashes
+- [Deserialization](#deserialization): object injection, gadget chains
+
+## Memory Corruption
+
+Buffer overflow, heap overflow, stack overflow, out-of-bounds read/write, use-after-free, double-free, type confusion.
+
+**Language safety check first:** Memory corruption in safe Rust, Go (without `unsafe.Pointer`/cgo), or managed languages (Java, C#, Python) is almost always a false positive: the type system or runtime prevents it. Verify whether the code is in an `unsafe` block (Rust), uses cgo/`unsafe.Pointer` (Go), or calls native code via JNI/P/Invoke. If the code is entirely in the safe subset, reject the memory corruption claim unless it involves a compiler bug or soundness hole.
+
+**Verify:**
+
+- What exactly gets corrupted? (which object, field, or memory region)
+- What is the corruption size and offset? Can the attacker control them?
+- Is the corruption a useful exploitation primitive (arbitrary read/write, vtable overwrite, function pointer overwrite) or just a crash?
+- What allocator is in use (glibc, tcmalloc, jemalloc, Windows heap)? Does it have hardening that blocks exploitation?
+- For UAF: trace the object lifetime: what frees it, what reuses the memory, can the attacker control the replacement object?
+- For type confusion: prove the type mismatch exists and that misinterpretation of the data leads to a useful primitive.
+
+## Logic Bugs
+
+Authentication bypass, access control errors, incorrect state transitions, confused deputy, privilege escalation through API misuse.
+
+**Verify:**
+
+- Check against the specification, RFC, or design docs: not just the code. Does the implementation match the intended behavior?
+- Map all state transitions. Can the system reach a state the developer didn't anticipate?
+- Identify implicit assumptions that are never enforced in code.
+- For auth bugs: verify ALL authentication/authorization paths, not just the one that appears broken. Is there a secondary check that catches it?
+- Logic bugs pass every bounds check and mathematical proof: don't let clean static analysis convince you it's a false positive.
+
+## Race Conditions
+
+TOCTOU, data races, signal handling races, concurrent state modification.
+
+**Verify:**
+
+- What is the actual race window? Is it nanoseconds or seconds?
+- Can the attacker widen the window (e.g., by stalling a thread with a slow NFS mount, large allocation, or CPU contention)?
+- Verify the threading model: what threads/processes can actually access this data concurrently?
+- Check all synchronization primitives in use: mutexes, atomics, RCU, lock-free structures.
+- For TOCTOU on filesystem: can the attacker control the path between check and use (symlink races)?
+
+## Integer Issues
+
+Overflow, underflow, truncation, signedness errors, wraparound.
+
+**Verify:**
+
+- What are the exact integer types and their ranges at every point in the computation?
+- Is the overflow signed (undefined behavior in C/C++: compiler may exploit this) or unsigned (defined wraparound)?
+- Trace the integer through all casts, conversions, and promotions. Where does truncation or sign extension occur?
+- After the integer issue occurs, is the resulting value actually used in a dangerous way (allocation size, array index, loop bound)?
+- Check if compiler warnings (`-Wconversion`, `-Wsign-compare`) flag this.
+
+## Crypto Weaknesses
+
+Weak algorithms, bad parameters, nonce reuse, padding oracle, insufficient randomness, timing side channels.
+
+**Verify:**
+
+- Check parameter choices against current standards (NIST, IETF) and known attacks. "AES-128" is fine; "DES" is not.
+- Verify randomness sources. Is the PRNG cryptographically secure? Is it properly seeded?
+- For nonce reuse: prove the same nonce can actually be used twice in practice, not just theoretically.
+- For timing side channels: is the code actually reachable by an attacker who can measure timing? Network jitter may make remote timing attacks impractical.
+- Compare the implementation against a reference implementation or test vectors from the spec.
+
+## Injection
+
+SQL injection, XSS, command injection, server-side template injection, path traversal, LDAP injection.
+
+**Verify:**
+
+- Trace attacker input from entry point to the sink (query, command, template, filesystem path). Is there any sanitization or escaping along the way?
+- Check if the framework provides automatic escaping (e.g., parameterized queries, template auto-escaping). If so, is it actually enabled and not bypassed?
+- For XSS: what context does the input land in (HTML body, attribute, JavaScript, URL)? Each requires different escaping.
+- For path traversal: is the path canonicalized before the access check? Can `../` or null bytes bypass validation?
+- Follow the actual payload through all intermediate processing (by reading the code, or by running it outside the repository): encoding, decoding, and transformation steps may neutralize or enable the payload.
+
+## Information Disclosure
+
+Uninitialized memory reads, error message leaks, timing side channels, padding oracles.
+
+**Verify:**
+
+- What specific data leaks? Not all leaks are equal: a stack leak revealing ASLR base or canary is critical; one revealing a static string is worthless.
+- Is the leaked data actually useful to an attacker for further exploitation (ASLR bypass, session tokens, crypto keys)?
+- For uninitialized memory: prove the memory is actually uninitialized at the point of read, not just potentially uninitialized on some code path.
+- For timing side channels: can the attacker make enough measurements with sufficient precision? What's the noise level?
+- For error messages: does the error path actually reach the attacker, or is it logged server-side only?
+
+## Denial of Service
+
+Algorithmic complexity, resource exhaustion, crash bugs, infinite loops, memory bombs.
+
+**Verify:**
+
+- What is the resource consumption ratio? Attacker sends X bytes, server consumes Y resources. Is the amplification meaningful?
+- Can the resource be reclaimed (connection closes, memory freed) or is it permanent exhaustion?
+- For algorithmic complexity: what is the actual worst-case input? Prove it triggers worst-case behavior, don't just claim O(n²).
+- For crash bugs: is the crash reliably triggerable, or does it depend on specific heap/stack layout?
+- Does the service restart automatically? A crash that causes a 100ms restart is different from one that requires manual intervention.
+
+## Deserialization
+
+Unsafe deserialization, object injection, gadget chain exploitation.
+
+**Verify:**
+
+- Does the attacker actually control the serialized data that reaches the deserialization call?
+- Does a usable gadget chain exist in the classpath/import graph? Without a gadget chain, unsafe deserialization is a design smell, not an exploitable bug.
+- What deserialization library and version is in use? Are there known gadget chains for it?
+- Are there type restrictions, allowlists, or look-ahead deserialization filters that block dangerous classes?
+- For language-specific: Java `ObjectInputStream`, Python `pickle`, PHP `unserialize`, .NET `BinaryFormatter` each have different exploitation characteristics.
+
+Part of the `false-positive-check` skill, adapted from https://github.com/trailofbits/skills/tree/main/plugins/fp-check (commit 5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0), CC BY-SA 4.0. Changed: punctuation and small wording changes for read-only runs.