VibeRPGSimulator

Skill that checks suspected security bugs one at a time and returns a true or false positive verdict with evidence after six gate reviews.

How it works

Foe: Mirage Djinn, an AI answer that sounds right but isn't.

Foes

  • Mirage Djinn

Party · Context

  • RogueYour agent100/100

  1. Mirage Djinn

    The Mirage Djinn blocks the way.

    What really happensIt stands for an AI answer that sounds right but isn't.

    Rogue: Context 100/100.

  2. Mirage

    The djinn conjures a mirage, and the hero swings at nothing.

    What really happensA model can sound sure and still be wrong, so AI features need evals and checks.

    Rogue takes 8. Rogue: Context 92/100.

  3. Trail of Bits fp-check

    The hero brings a finding before the tribunal.

    What really happensAsk whether a suspected bug is real or exploitable. Clear bugs take a standard checklist; cross-component, race or logic bugs take the deep path.

    Mirage Djinn takes 23.

  4. Trail of Bits fp-check

    Three helpers trace the path from gate to treasury.

    What really happensAgents trace data from source to sink, test attacker control and bounds, and build pseudocode, executable or unit test proofs of concept.

    data-flow-analyzer: Context 40/40. exploitability-verifier: Context 40/40. poc-builder: Context 40/40.

  5. Mirage

    The Mirage Djinn lashes at data-flow-analyzer.

    What really happensThe subagent takes the hit in its own context. The main context stays clean.

    data-flow-analyzer takes 8. data-flow-analyzer: Context 32/40.

  6. Trail of Bits fp-check

    The summons work the problem, each in its own context.

    What really happensEach subagent does its own model and tool work, apart from the main conversation.

    Mirage Djinn takes 9. Mirage Djinn takes 9. Mirage Djinn takes 10.

  7. Trail of Bits fp-check

    The summons return with short reports.

    What really happensOnly the subagent's final summary comes back to the main agent.

    Rogue takes 2. Rogue takes 2. Rogue takes 2. Rogue: Context 86/100. Rogue: Insight. data-flow-analyzer returns. exploitability-verifier returns. poc-builder returns.

  8. Trail of Bits fp-check

    A devil's advocate questions every claim, its own included.

    What really happensA devil's advocate review asks targeted questions with a check for hallucinated evidence, then six mandatory gates run.

    Mirage Djinn takes 11. Rogue: Ward.

  9. Trail of Bits fp-check

    The illusion fades and only true wounds remain.

    What really happensEach bug gets TRUE POSITIVE or FALSE POSITIVE with documented evidence. A hook keeps the agent working until every verdict is in.

    Mirage Djinn takes 38. Mirage Djinn falls.

  10. Victory

    The Mirage Djinn falls.

Learn this spell

Claude Code

/plugin marketplace add trailofbits/skills
/plugin install fp-check

Codex

codex plugin marketplace add trailofbits/skills
codex plugin add fp-check@trailofbits

Notes

Version 1.0.5, by Maciej Domanski. Triggers when you ask whether a finding is real; it does not hunt for new bugs. Ships three agents (data-flow-analyzer, exploitability-verifier, poc-builder) and Stop and SubagentStop prompt hooks that block stopping until every bug has a verdict. The hooks match every stop, so trials flag the plugin and run it only with --allow-hazards. Codex: codex plugin marketplace add trailofbits/skills, then codex plugin add fp-check@trailofbits.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.