ghost-validate

# Security Finding Validation Determine whether a security finding is a true positive or false positive. Produce a determination with supporting evidence. ## Input The user provides a finding as a file path or pasted text. If neither is provided, ask for one. Extract: vulnerability class, specific claim, affected endpoint, code location, and any existing validation evidence. ## Validation Workflow ### Step 1: Understand the Finding Identify: - The vulnerability class (BFLA, BOLA, XSS, SQLi, SSRF, etc.) - The specific claim being made (what authorization check is missing, what input is unsanitized, etc.) - The affected endpoint and HTTP method - The code location ### Step 2: Analyze the Source Code 1. Read the vulnerable file at the specified line number and all supporting files 2. Trace the request flow from route registration through middleware to the handler 3. Verify the specific claim — does the code actually lack the described check? 4. Look for indirect protections (middleware, helpers, ORM constraints) the scanner may have missed 5. Confirm the vulnerable code path is reachable under the described conditions ### Step 3: Live Validation (When Available) If a live instance of the application is accessible and the vulnerability can be confirmed through live interaction, use the `proxy` skill to confirm exploitability: 1. Start reaper proxy scoped to the target domain 2. Authenticate (or have the user authenticate) as a legitimate user and capture a valid reque...