Against, please take your time and read:
https://github.com/rapid7/metasploit-framework/wiki/How-to-write-a-check()-method

"vulnerable" and "appears" don't actually go together :-) When a check says something is vulnerable because it's able to trigger the bug and prove it. It only "appears" so when your check is based on passive reconnaissance.

Thanks.