ghost-validate

Validate security findings by analyzing code flows, testing exploit conditions, and confirming true vs. false positives. Determine whether a security finding is a true positive or false positive. Produce a determination with supporting evidence. The user provides a finding as a file path or pasted text. If neither is provided, ask for one. Extract: vulnerability class, specific claim, affected endpoint, code location, and any existing validation evidence. Identify: If a live instance of the application is accessible and the vulnerability can be confirmed through live interaction, use the proxy skill to confirm exploitability: Classify the finding as one of: Output a summary in the following format: Example: If the finding was provided as a file path, ask the user if they would like to append the validation details to the original finding file. If they agree, append a ## Validation section to the file containing the determination, confidence, evidence summary, and recommendation.