ワンクリックでManusで任意のスキルを実行

code-graph

スター0

フォーク0

更新日2026年5月29日 02:51

Build a cached code-graph (.kuzushi/code-graph.json) — entry points + per-symbol caller counts (blast-radius / attack-surface signal) — so producers like /diff-review query it instead of re-deriving caller info live. Uses real Joern call edges when a CPG is built, else a deterministic ripgrep heuristic (no heavy tooling required). Re-run after large code changes.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

allsmog

allsmog/kuzushi-security-plugin

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Code graph

Build (or refresh) the persistent code-graph for this repository.

Run, using the project working directory as <repo>:

node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/code-graph-build.mjs" --target "<repo>"

It writes .kuzushi/code-graph.json ({ entryPoints[], symbols:[{name,file,line,callerCount}], … }, symbols ranked by callerCount — the blast-radius signal) and prints a summary (definition count, top symbols, whether a Joern CPG is present for a higher-fidelity upgrade). Relay the summary.

Consumers read the artifact when present: /diff-review uses each changed symbol's callerCount for a deterministic blast radius (instead of live caller counting), and the hunters may consult it for reachability. With a Joern CPG present (/build-databases) it uses real call edges (callIn counts); otherwise it's a ripgrep call-site tally — either way re-run it after big changes.

When NOT to use

As a vulnerability finder — it's a structural index, not a hunter; it makes no security judgments.
On a repo you haven't changed since the last build — the cached artifact is still valid; only re-run after meaningful code changes.

Rationalizations to Reject

"The caller count is exact." → Only with the Joern backend (real callIn edges). The ripgrep fallback is a call-site tally — a blast-radius signal, not a true graph. Check the backend field.
"No graph, so skip blast radius." → Without the cached graph, /diff-review still falls back to live caller counting — the graph just makes it cheaper and repo-wide.

このリポジトリの他の Skills

同じリポジトリ

deep-hunt

allsmog/kuzushi-security-plugin

Interprocedural, hypothesis-driven hunt — finds the multi-file source→sink bugs that pattern-gating and same-file taint miss. Ranks trace anchors (entry points + dangerous sinks), then the deep-hunter agent walks each flow ACROSS files (forward/backward call-graph CLIs) over multiple rounds, confirming propagation and defeating guards, and promotes confirmed cross-file flows into findings.json with the path stored as evidenceGraph. Token-expensive, budget-bounded. Part of the HUNT phase (run via /sweep --deep, or ask for it); leads flow to /verify (panel).

2026-06-110

deep-scan

allsmog/kuzushi-security-plugin

Whole-file deep reader — finds bugs by READING risk-ranked files in full and reasoning from first principles, not by grepping for known patterns. Catches the long tail (project-specific wrappers, business logic, cross-function flaws) that pattern-gated producers structurally miss. Token-expensive; budget-bounded and risk-ranked. Promotes leads into .kuzushi/findings.json (source "deep-scan").

2026-06-110

taint-analysis

allsmog/kuzushi-security-plugin

IRIS-style source→sink taint hunt. Ranks a typed CWE catalog for the repo, then drives subagents to label dangerous sinks, label sources of user input, run Joern/CodeQL dataflow queries (or same-file linking) to connect them, and triage each flow as finding/candidate/rejected. Promotes verdicts into .kuzushi/findings.json. Benefits from a prebuilt CodeQL DB / Joern CPG but degrades gracefully.

2026-06-110

threat-hunt

allsmog/kuzushi-security-plugin

Adversarial per-threat review (Carlini doctrine). For each threat in .kuzushi/threat-model.json, state attacker capabilities, walk source→sink, attempt to bypass every guard, and assign a verdict with evidence. Promotes findings into .kuzushi/findings.json. Requires /threat-model first.

2026-06-110

partition

allsmog/kuzushi-security-plugin

Split the attack surface into parallel-discovery partitions so fan-out hunters explore different subsystems instead of converging on the same shallow bug. Deterministic grouping of /x-ray entry points by component → .kuzushi/partitions.json, which a hunt coordinator hands to one subagent per partition. Run /x-ray first.

2026-06-100

poc

allsmog/kuzushi-security-plugin

Empirical proof-of-concept for the PoC-ready findings. For each finding /verify marked confirmed-exploitable or inconclusive, synthesize a minimal harness that triggers the bug; a host script then runs it in a sandbox (Docker --network none when present, else a gated local run) and classifies the crash into a proof verdict. Attaches a poc block onto each finding. Requires /verify first.

2026-06-100

name	code-graph
user-invocable	false
description	Build a cached code-graph (.kuzushi/code-graph.json) — entry points + per-symbol caller counts (blast-radius / attack-surface signal) — so producers like /diff-review query it instead of re-deriving caller info live. Uses real Joern call edges when a CPG is built, else a deterministic ripgrep heuristic (no heavy tooling required). Re-run after large code changes.
allowed-tools	Bash

Code graph

Build (or refresh) the persistent code-graph for this repository.

Run, using the project working directory as <repo>:

node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/code-graph-build.mjs" --target "<repo>"

When NOT to use

As a vulnerability finder — it's a structural index, not a hunter; it makes no security judgments.
On a repo you haven't changed since the last build — the cached artifact is still valid; only re-run after meaningful code changes.

Rationalizations to Reject

"The caller count is exact." → Only with the Joern backend (real callIn edges). The ripgrep fallback is a call-site tally — a blast-radius signal, not a true graph. Check the backend field.
"No graph, so skip blast radius." → Without the cached graph, /diff-review still falls back to live caller counting — the graph just makes it cheaper and repo-wide.