/validation

name: validation
description: Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
metadata:
  short-description: Validate candidate security findings

Security Validation

Objective

Take candidate findings from discovery and produce the strongest evidence-backed validation assessment you can. Prefer targeted, non-interactive reproduction or falsification when it is feasible and proportionate, but use focused code tracing when dynamic execution is blocked by missing services, unavailable infrastructure, or excessive setup relative to the candidate and scan scope.

Artifact Resolution

The path references in this skill are the default locations for this phase. If the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill. If a required input is still missing, stop and ask the user for it before continuing. Use the shared scan artifact path conventions in `../../references/scan-artifacts.md`.

Workflow

1. Before starting, create a detailed validation rubric with up to five criteria for the candidate. 2. For each candidate finding, identify the claimed attacker input, vulnerable sink, and preconditions. 3. Choose the validation path using the strongest realistic method available:

• crash: for crash, memory-corruption, parser-confusion, or denial-of-service candidates, attempt to compile a debug variant and produce a crashing PoC when the project can be built with bounded effort.
• valgrind or ASan: if a memory-safety or crash candidate does not immediately reproduce and the build supports it, attempt valgrind and/or ASan.
• debugger: if runtime execution is available but the chain is unclear, attempt a non-interactive debugger trace with gdb/lldb that shows the source-to-sink path.
• unit or integration test: if the vulnerable path is covered by an existing test harness, add or adapt the smallest focused test that exercises the vulnerable code and asserts the vulnerable behavior.
• realistic interface reproduction: if the code exposes a real user-reachable interface such as HTTP, CLI, file parser, RPC, message queue, plugin hook, or package API, attempt a minimal end-to-end reproduction through that interface using crafted input that reaches the suspected sink.
• code understanding: if dynamic reproduction is not feasible or proportionate after bounded attempts, perform focused code tracing from attacker-controlled input to the sink, identify preconditions and guards, and state whether the vulnerability is supported or defeated by the code path.
• large internal repository mode: for repository-wide or scoped-path scans where runtime reproduction requires unavailable internal services, secrets, cloud accounts, service meshes, or local production data, use static trace plus existing tests and deploy/config evidence once the candidate has a complete source/control/sink/impact tuple. Missing internal runtime setup is not suppression evidence.

4. For non-compiled stacks, attempt to generate PoCs or targeted commands that exercise the vulnerable path and trigger the vulnerability. 5. For compiled stacks, prefer dynamic validation when it is feasible with bounded setup: build a debug variant or targeted test harness when available, reproduce the vulnerable behavior with a small PoC, then use valgrind, ASan, or a non-interactive debugger trace when those tools materially improve confidence. 6. Save any PoC files, inputs, or logs under that finding's validation artifacts path from `../../references/scan-artifacts.md`. 7. If validation is not feasible, document what was tried, what remains uncertain, and the exact proof gap. 8. Return a clear validation assessment per finding grounded in the evidence, proof gaps, and remaining uncertainty. 9. Save that finding's visible validation report to its per-finding validation report path from `../../references/scan-artifacts.md`. 10. Append one validation receipt per candidate id to that finding's candidate ledger path from `../../references/scan-artifacts.md`. The receipt must record the validation method, evidence or exact proof gap, disposition, and validation artifact/report reference for that candidate finding.

Usage Guidance

• Prefer short, bounded commands (git, grep -nI within changed dirs, build/test runners, minimal PoCs).
• Avoid interactive editors (vi), long-running repo-wide scans, and network access unless essential.
• If you need to use debuggers, invoke them non-interactively (gdb: "-q -batch -ex run -ex bt -ex quit"; lldb: "-b -o run -o bt -o quit").
• When creating PoCs to validate the vulnerability, you should attempt to trigger them against the actual application/library directly. Ideally this shows how an attacker would trigger the bug.

Validation Guidance

Follow the instance-preserving validation rules, validation checklist, and confidence guidance in `references/validation-guidance.md`.

Output Contract

For each candidate finding, include:

• finding title
• candidate id, instance key, and ledger row id when provided
• root-control file:line and affected-location labels from discovery when provided
• advisory/source reference and seed anchor file:line when provided, especially when distinct from the root-control line
• confidence level
• validation method used or recommended
• rubric checklist with `- [x]` or `- [ ]` items
• evidence observed
• concise notes on what was tested
• remaining uncertainty
• minimal next step if more proof is needed
• artifact paths when validation files or logs were created
• enough detail that a later reader can tell whether the finding survived validation without relying on a separate status label

For repository-wide and scoped-path sc