Menu
Run an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Model a library method's taint propagation as a passThrough approximation config. Use for a dropped external method whose propagation is simple copying
Author and verify an OpenTaint detection rule for a vulnerability class on JVM code. Use whenever a rule needs to be created for an uncovered vulnerability, or an existing rule needs a false-positive or false-negative fix
Create an OpenTaint test project with annotated positive/negative samples for verifying a rule or approximation. Use when a rule or approximation needs a test project to check against
Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped. Use when its samples won't pass after repeated attempts, or it passes tests but is wrong on a real scan
Write an OpenTaint engine-issue report from a confirmed diagnosis, optionally opening a GitHub issue. Use when engine-side issue got confirmed and requires report
Mark which of a project's dependency libraries could introduce taint sources or sinks. Use to start attack-surface discovery
| name | run-scan |
| description | Run an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project |
| license | Apache-2.0 |
| metadata | {"author":"opentaint","version":"0.2"} |
Run an OpenTaint scan over a project and collect results
From the caller; if omitted, fall back to the default. Ask only when a required input is missing and has no sensible default
<model-dir> / <project-src> — pre-compiled model or source project directory. Default: model at .opentaint/project<rules-dir> — Default: builtin plus .opentaint/rules if present<full-id> (optional) — full IDs to restrict the scan to, omit to run all loaded rules<report.sarif> — Default: .opentaint/results/report.sarif<config-dir> (optional) — a passThrough YAML file or a directory of them. Default: .opentaint/pass-through<approx-dir> (optional) — Default: .opentaint/dataflowPoint at the code either way: a source project (CLI compiles it) as the positional scan <project-src>, or a pre-built model via --project-model <model-dir>. If project model provided prefer using it instead of source project
opentaint scan --project-model <model-dir> \
-o <report.sarif> \
--ruleset builtin --ruleset <rules-dir> \
--track-external-methods
Append optional flags as needed:
--rule-id <full-id> — restrict to specific rules (repeatable); omit to run all loaded rules--passthrough-approximations <config-dir> — apply passThrough configs from a YAML file or a directory of them (OVERRIDE: merged with built-ins at the rule level, a provided rule overrides a built-in only when it matches one; repeatable)--dataflow-approximations <approx-dir> — apply code-based approximations (Java sources, auto-compiled; or pre-compiled .class dirs, passed through as-is)Three files, all next to the SARIF report:
<report.sarif> — findings with code-flow tracesdropped-external-methods.yaml — methods where dataflow facts were killed (no approximation model) → candidates to approximate; possible source of false negativesapproximated-external-methods.yaml — methods already modeled| Flag | Purpose |
|---|---|
--project-model | Pre-compiled model directory (omit to scan a source project via the positional arg) |
--ruleset | Rule directory (repeatable); builtin for built-ins |
--rule-id | Restrict to specific full rule IDs (repeatable) |
--passthrough-approximations | passThrough configs: a YAML file or directory of them (OVERRIDE, repeatable) |
--dataflow-approximations | Directory of Java sources or compiled classes (repeatable) |
--track-external-methods | Emit dropped-external-methods.yaml + approximated-external-methods.yaml next to the SARIF |
--timeout | Analysis timeout (default 900s) |
.opentaint/ layout when the caller omits them; the caller can override any of them