تشغيل أي مهارة في Manus بنقرة واحدة

code-graph

النجوم٠

التفرعات٠

آخر تحديث٢٩ مايو ٢٠٢٦ في ٠٢:٥١

Build a cached code-graph (.kuzushi/code-graph.json) — entry points + per-symbol caller counts (blast-radius / attack-surface signal) — so producers like /diff-review query it instead of re-deriving caller info live. Uses real Joern call edges when a CPG is built, else a deterministic ripgrep heuristic (no heavy tooling required). Re-run after large code changes.

التثبيت

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

تشغيل في Manus

المصدر

allsmog

allsmog/kuzushi-security-plugin

فتح مستودع GitHub عرض مستودعات المنشئ

تنزيل

تشغيل في Manus

المهن ذات الصلةSOC

استنادا إلى تصنيف SOC المهني

مطوّرو البرمجياتمهن الحاسوب والرياضيات·SOC 15-1252

SKILL.md

readonly

name	code-graph
user-invocable	false
description	Build a cached code-graph (.kuzushi/code-graph.json) — entry points + per-symbol caller counts (blast-radius / attack-surface signal) — so producers like /diff-review query it instead of re-deriving caller info live. Uses real Joern call edges when a CPG is built, else a deterministic ripgrep heuristic (no heavy tooling required). Re-run after large code changes.
allowed-tools	Bash

Code graph

Build (or refresh) the persistent code-graph for this repository.

Run, using the project working directory as <repo>:

node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/code-graph-build.mjs" --target "<repo>"

It writes .kuzushi/code-graph.json ({ entryPoints[], symbols:[{name,file,line,callerCount}], … }, symbols ranked by callerCount — the blast-radius signal) and prints a summary (definition count, top symbols, whether a Joern CPG is present for a higher-fidelity upgrade). Relay the summary.

Consumers read the artifact when present: /diff-review uses each changed symbol's callerCount for a deterministic blast radius (instead of live caller counting), and the hunters may consult it for reachability. With a Joern CPG present (/build-databases) it uses real call edges (callIn counts); otherwise it's a ripgrep call-site tally — either way re-run it after big changes.

When NOT to use

As a vulnerability finder — it's a structural index, not a hunter; it makes no security judgments.
On a repo you haven't changed since the last build — the cached artifact is still valid; only re-run after meaningful code changes.

Rationalizations to Reject

"The caller count is exact." → Only with the Joern backend (real callIn edges). The ripgrep fallback is a call-site tally — a blast-radius signal, not a true graph. Check the backend field.
"No graph, so skip blast radius." → Without the cached graph, /diff-review still falls back to live caller counting — the graph just makes it cheaper and repo-wide.

المزيد من هذا المستودع

نفس المستودع

deep-hunt

allsmog/kuzushi-security-plugin

Interprocedural, hypothesis-driven hunt — finds the multi-file source→sink bugs that pattern-gating and same-file taint miss. Ranks trace anchors (entry points + dangerous sinks), then the deep-hunter agent walks each flow ACROSS files (forward/backward call-graph CLIs) over multiple rounds, confirming propagation and defeating guards, and promotes confirmed cross-file flows into findings.json with the path stored as evidenceGraph. Token-expensive, budget-bounded. Part of the HUNT phase (run via /sweep --deep, or ask for it); leads flow to /verify (panel).

2026-06-110

deep-scan

allsmog/kuzushi-security-plugin

Whole-file deep reader — finds bugs by READING risk-ranked files in full and reasoning from first principles, not by grepping for known patterns. Catches the long tail (project-specific wrappers, business logic, cross-function flaws) that pattern-gated producers structurally miss. Token-expensive; budget-bounded and risk-ranked. Promotes leads into .kuzushi/findings.json (source "deep-scan").

2026-06-110

taint-analysis

allsmog/kuzushi-security-plugin

IRIS-style source→sink taint hunt. Ranks a typed CWE catalog for the repo, then drives subagents to label dangerous sinks, label sources of user input, run Joern/CodeQL dataflow queries (or same-file linking) to connect them, and triage each flow as finding/candidate/rejected. Promotes verdicts into .kuzushi/findings.json. Benefits from a prebuilt CodeQL DB / Joern CPG but degrades gracefully.

2026-06-110

threat-hunt

allsmog/kuzushi-security-plugin

Adversarial per-threat review (Carlini doctrine). For each threat in .kuzushi/threat-model.json, state attacker capabilities, walk source→sink, attempt to bypass every guard, and assign a verdict with evidence. Promotes findings into .kuzushi/findings.json. Requires /threat-model first.

2026-06-110

partition

allsmog/kuzushi-security-plugin

Split the attack surface into parallel-discovery partitions so fan-out hunters explore different subsystems instead of converging on the same shallow bug. Deterministic grouping of /x-ray entry points by component → .kuzushi/partitions.json, which a hunt coordinator hands to one subagent per partition. Run /x-ray first.

2026-06-100

poc

allsmog/kuzushi-security-plugin

Empirical proof-of-concept for the PoC-ready findings. For each finding /verify marked confirmed-exploitable or inconclusive, synthesize a minimal harness that triggers the bug; a host script then runs it in a sandbox (Docker --network none when present, else a gated local run) and classifies the crash into a proof verdict. Attaches a poc block onto each finding. Requires /verify first.

2026-06-100

name	code-graph
user-invocable	false
description	Build a cached code-graph (.kuzushi/code-graph.json) — entry points + per-symbol caller counts (blast-radius / attack-surface signal) — so producers like /diff-review query it instead of re-deriving caller info live. Uses real Joern call edges when a CPG is built, else a deterministic ripgrep heuristic (no heavy tooling required). Re-run after large code changes.
allowed-tools	Bash

Code graph

Build (or refresh) the persistent code-graph for this repository.

Run, using the project working directory as <repo>:

node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/code-graph-build.mjs" --target "<repo>"

When NOT to use

As a vulnerability finder — it's a structural index, not a hunter; it makes no security judgments.
On a repo you haven't changed since the last build — the cached artifact is still valid; only re-run after meaningful code changes.

Rationalizations to Reject

"The caller count is exact." → Only with the Joern backend (real callIn edges). The ripgrep fallback is a call-site tally — a blast-radius signal, not a true graph. Check the backend field.
"No graph, so skip blast radius." → Without the cached graph, /diff-review still falls back to live caller counting — the graph just makes it cheaper and repo-wide.