dynamic-verificationlisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/dynamic-verification/SKILL.md. --> # Verify Findings Confirm or refute a vulnerability candidate against a live target with a deterministic probe (the agent runs the probe, respecting authorization and scope) ## ALWAYS - Treat a static-analysis or LLM-review hit as a *candidate*, not a vulnerability, until a probe with a deterministic oracle confirms it against a live target. - Prefer an oracle that proves server-side behaviour over one that inspects the response text: out-of-band callbacks (SSRF, blind command injection, XXE) and timing deltas (blind SQLi, command injection) catch *blind* bugs that leave no trace in the body. - Re-confirm any timing-based result a second time before trusting it — one slow response is noise, a repeatable delay over baseline is signal. - For reflected oracles (XSS, SSTI), require the dangerous form: XSS confirms only when the payload comes back UNESCAPED; SSTI confirms only when the arithmetic is EVALUATED (the product appears as a standalone number and the raw expression does not). - Pin file-read oracles (path traversal) to a content signature of a known system file (`root:…:0:0:` from `/etc/passwd`, `[fonts]` from `win.ini`), never to a generic 200/404. - Drive the probe yourself with SecureVibe's scope-gated primitives: `http_probe` (send one crafted request, read status/headers/body/timing) a