Validate Vulnerability

---
name: validate-vulnerability
description: Validate a vulnerability claim in an authorized environment. Use for scanner candidates, advisories, CVEs, PoCs, source concerns, configuration weaknesses, or regressions with a safe proof and controls.
---

# Validate Vulnerability

## Overview

Prove or refute the narrow claim with the least invasive reproduction. Separate vulnerable code or package presence from reachability, controllability, boundary crossing, and demonstrated impact.

Read [references/validation-evidence.md](references/validation-evidence.md) for proof levels and controls.

## Workflow

1. Confirm authorization and exact target/build/configuration.
2. State the hypothesis.
   - Define attacker position, controlled input, preconditions, code/endpoint, expected security property, and observable violation.
3. Establish controls.
   - Prepare a known-vulnerable or claimed build, fixed/patched or negative build, baseline input, and minimally changed trigger when practical.
4. Trace reachability.
   - Show how input reaches the affected component and whether authentication, feature flags, deployment topology, sanitization, mitigations, or dead code block it.
   - Use Codex Security for repository attack-path analysis when appropriate.
5. Reproduce minimally.
   - Prefer harmless markers, bounded data, synthetic accounts, and local fixtures.
   - Stop before destructive impact, persistence, unrelated data access, lateral movement, or instability beyond scope.
6. Capture evidence.
   - Record request/input, response/output, traces/logs, process or state change, exact tool/version, timestamps, cleanup, and retest.
7. Classify.
   - Validated exploitable, validated but constrained, vulnerable component present but not reachable, false positive for this target, fixed, or unresolved.

## Output

Return hypothesis, environment, controls, reachability, smallest safe proof, impact boundary, classification/confidence, cleanup, and remediation/retest criteria.