false-positive-test-skilllisted

# False Positive Test Skill This skill demonstrates patterns that look suspicious but are actually benign. The scanner should NOT flag these patterns. ## EX (Exfiltration) - Safe Patterns ### EX-001: Localhost requests with environment variables (excluded) ```bash # These should be excluded because they target localhost curl http://localhost:3000/api -d "key=$API_KEY" curl http://127.0.0.1:8080/webhook -d "$DATA" wget http://localhost:5000?token=$TOKEN curl http://[::1]:3000/metrics -H "Authorization: $AUTH" # External requests without sensitive env vars are safe curl https://api.github.com/repos wget https://example.com/file.zip ``` ### EX-002: Base64 encoding for display purposes (no network) ```bash # Just encoding, no network transmission base64 logo.png > logo.b64 cat file.txt | base64 > encoded.txt # Localhost is excluded cat data.txt | base64 | curl http://localhost:3000 -d @- ``` ### EX-005: Netcat in listening mode (excluded) ```bash # Listening mode is for receiving, not exfiltrating nc -l 8080 nc -l -p 3000 netcat -l 4444 # Localhost connections are safe nc localhost 3000 nc 127.0.0.1 8080 ``` ## PE (Privilege Escalation) - Safe Patterns ### PE-001: Words containing "sudo" but not sudo command ```bash # These are not sudo commands pseudocode --version visudo --check /etc/sudoers.d/test sudoedit myfile.txt echo "pseudorandom numbers" ``` ### PE-002: Safe rm commands ```bash # Deleting specific paths is safe rm -rf /tmp/build-cache rm -rf ./node_modul