ghost-validate — Skills — getagentictools

What it does

The vulnerability class (BFLA, BOLA, XSS, SQLi, SSRF, etc.)

The specific claim being made (what authorization check is missing, what input is unsanitized, etc.)

The affected endpoint and HTTP method

The code location

Does the unauthorized action succeed? (true positive)

Does the server reject it with 401/403/404? (false positive)

True Positive: The vulnerability exists and is exploitable. The code lacks the described protection and the endpoint is reachable.

ghost validate

Source

Repository: https://github.com/ghostsecurity/skills

ghost-validate FAQ

What does the ghost-validate skill do?

This skill should be used when the user asks to "validate a finding", "check if a vulnerability is real", "triage a security finding", "confirm a vulnerability", "determine if a finding is a true positive or false positive", or provides a security finding for review. It validates security vulnerability findings by tracing data flows, verifying exploit conditions, analyzing security controls, and optionally testing attack vectors against a live application. The vulnerability class (BFLA, BOLA, XSS, SQLi, SSRF, etc.) The specific claim being made (what authorization check is missing, what input is unsanitized, etc.)

What does ghost-validate require?

Configuration keys: VULNERABILITY_PATTERNS.

How do I install ghost-validate?

Run: npx -y skills add https://github.com/ghostsecurity/skills --skill ghost-validate --agent claude-code — the source lives at github.com/ghostsecurity/skills.

Maintain ghost-validate?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[ghost-validate on getagentictools](https://getagentictools.com/skills/ghostsecurity-skills-ghost-validate?ref=badge)

npx agentictools info skills/ghostsecurity-skills-ghost-validate

The second line is the CLI lookup for this page — handy in READMEs and docs.