| name | vulnerability-analysis |
| description | Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks |
| metadata | {"type":"offensive","phase":"analysis","tools":"codeql, semgrep, joern, opengrep, trufflehog, gitleaks, kingfisher, osv-scanner, syft, grype, trivy, npm-audit, pip-audit, ysoserial, phpggc","mitre":["T1190","T1059","T1552.001","T1195.001","T1213"]} |
| kill_chain | {"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0002","TA0001"],"attck_techniques":["T1190","T1059","T1552.001","T1195.001","T1195.002"]} |
| depends_on | ["recon-osint"] |
| feeds_into | ["exploit-development","web-pentest"] |
| inputs | ["attack_surface_map","source_code"] |
| outputs | ["vulnerability_list","taint_analysis_report","finding_record","sbom"] |
| references | ["references/taint-engines-static-analysis.md","references/injection-source-patterns.md","references/memory-safety-c-cpp.md","references/deserialization-prototype-pollution.md","references/secrets-crypto-authz-concurrency.md","references/supply-chain-dependency-audit.md","references/variant-hunting.md"] |
| scripts | ["scripts/taint_trace.py","scripts/sast_runner.py","scripts/joern_taint.sc","scripts/deser_gadget_scan.py","scripts/secret_crypto_audit.py","scripts/dep_audit.py","scripts/validate_findings.py","scripts/evidence_kit.py","scripts/variant_hunt.py","scripts/path_conditions.py","scripts/merge_runtime_evidence.py"] |
