メニュー
Taint analysis methodology for code audit. Provides sink identification, backward tracing, source location, sanitization checking, and report generation. Load when analyzing data flow vulnerabilities.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Feature-centric deep incremental security review harness for Git-backed code changes, with autonomous, agents, and hybrid execution modes.
Optional graph-context enrichment for feature-centric incremental security review using CodeGraph or code-review-graph when available.
Pre-report finding verification contract. Re-checks whether each vulnerability has a real external Source, reachable Sink, bypassable or missing sanitization, and practical exploitability before final reporting.
Sink chain deep tracing methodology with graded code output templates (Critical full-chain / High-Medium key-nodes), reverse tracking rules, and per-hop Read verification.
Agent contract templates for R1 and R2+ rounds, including output format, token budget management, truncation defense, and auto-injection prompt templates.
Jalor internal Spring framework audit extension for endpoint operation authorization and service audit logging coverage.
| name | taint-analysis |
| description | Taint analysis methodology for code audit. Provides sink identification, backward tracing, source location, sanitization checking, and report generation. Load when analyzing data flow vulnerabilities. |
当给定漏洞位置 (file:line) 时，执行以下污点分析流程：
Source → [Transform₁ → Transform₂ → ... → Transformₙ] → Sink
对每个 Sink:
典型中间层命名模式: *Builder, *Provider, *Manager, *Utils, *Helper, *Handler, *Str*, *Trans*, *Process*, *Assemble*, *Render*, *Compile*
中间转换层若接受外部参数但无清洗/参数化 → 标记为独立注入入口。
完整污点分析方法论见: references/core/taint_analysis.md (使用 Read 工具加载)
Sink/Source 完整定义库: references/core/sinks_sources.md
LSP增强追踪指南: references/core/semantic_search_guide.md