Security Validation

Objective

Take candidate findings from discovery and produce the strongest evidence-backed validation assessment you can. Prefer targeted, non-interactive reproduction or falsification when it is feasible and proportionate, but use focused code tracing when dynamic execution is blocked by missing services, unavailable infrastructure, or excessive setup relative to the candidate and scan scope.

Artifact Resolution

The path references in this skill are the default locations for this phase. If the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill. If a required input is still missing, stop and ask the user for it before continuing. Use the shared scan artifact path conventions in ../../references/scan-artifacts.md.

Standard scans and Deep Scan workers validate findings within their ordinary Standard scan workflow; neither invokes this separate phase skill.

Compact Workbench-Backed Diff Mode

When a workbench-backed $security-diff-scan has a scanId, read the full candidate set with list_codex_security_candidates({ scanId, cursor?, limit? }). Apply the evidence rules below, preserve every discovery field and the original candidate order, and submit every disposition together with one record_codex_security_candidate_validations({ scanId, validations: [{ candidateId, validation }] }) call. Submit validations: [] when the candidate set is empty. The existing tool atomically updates the stored candidates; do not create per-finding reports, receipts, closure tables, or manual candidate ledgers in this compact diff mode. Create <discovery_dir>/validation_artifacts/<candidate_id>/ only for an actual PoC, crafted input, or log and reference it from the nested record. Other scan and standalone workflows retain their existing artifact behavior.