run-poc

Generates proof-of-concept exploit reasoning to verify security fix effectiveness.

2|Updated Mar 7, 2025
One-click install
npx skills add https://github.com/AbdelrhmanUZaki/KnowledgeNuggets --skill run-poc-abdelrhmanuzaki
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: run-poc
Source: https://github.com/AbdelrhmanUZaki/KnowledgeNuggets/tree/main/2-setup/shared/gemini/antigravity-ide/plugins/Google.securecoder.securecoder/skills/run_poc
Command: npx skills add https://github.com/AbdelrhmanUZaki/KnowledgeNuggets --skill run-poc-abdelrhmanuzaki

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? After applying a security fix, teams lack a structured way to confirm the vulnerability is actually no longer exploitable. This Skill produces a PoC verification artifact that reasons through an exploit scenario against the patched code and documents whether the remediation holds. ## Core Features & Use Cases - PoC Scenario Generation: Describes concrete exploit inputs and attack paths for vulnerability types including path traversal, XSS, SQL injection, SSRF, and insecure deserialization. - Step-by-Step Exploit Reasoning: Traces the exploit input through the patched code to determine whether the fix intercepts it, without executing any malicious code. - Walkthrough Integration: Writes a structured ## PoC Verification section into walkthrough.md with vulnerability summaries, fix analysis tables, and a verified/incomplete conclusion. - Use Case: After patching a path traversal flaw flagged by a scanner, use this Skill to reason through a ../../etc/passwd request against the new validation logic and record the verification outcome for the security audit report. ## Quick Start Verify the applied fix for the SQL injection finding by generating a PoC verification section in walkthrough.md.

Frequently Asked Questions about run-poc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a security fix actually works?▼

Describe a concrete exploit scenario for the vulnerability, then trace the malicious input through the patched code step by step to confirm the fix intercepts it. Record the analysis in a PoC Verification section with a verified or incomplete conclusion.

How to write a proof of concept for a patched vulnerability?▼

Define the attacker's crafted input, the code path it follows, and the expected malicious outcome if unpatched. Then reason through the patched flow without executing the exploit, documenting where the fix blocks it.

When should PoC verification run in a remediation pipeline?▼

Run it only after a threat model has classified the finding as a true positive and a fix patch has been applied. Running it before remediation is premature; use threat modeling first to evaluate scanner findings.

Does PoC verification replace re-running a security scanner?▼

No, it complements scanner re-runs rather than replacing them. Scanners check for known vulnerability patterns, while PoC reasoning tests actual exploitability of the specific patched code path.

What happens if the PoC shows the fix is incomplete?▼

The verification is flagged as incomplete with an explanation of why the exploit would still succeed. The output recommends specific additional code changes needed to fully remediate the vulnerability.