メニュー
Drives the per-language SAST fleet. Decides which analyzers to run based on audit-context-building output, merges SARIF, deduplicates, and produces a single ranked list in reports/sast-merged.sarif.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | static-analysis-orchestrator |
| description | Drives the per-language SAST fleet. Decides which analyzers to run based on audit-context-building output, merges SARIF, deduplicates, and produces a single ranked list in reports/sast-merged.sarif. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/static-analysis |
After audit-context-building has populated reports/00-context.md.
for each language detected:
run Semgrep with language pack
run language-native analyzer (see table below)
write SARIF to reports/sast-<lang>-<tool>.sarif
merge → reports/sast-merged.sarif
dedupe by (file, line, rule_id)
| Language | Native analyzer(s) |
|---|---|
| Python | bandit, dlint |
| JS / TS | njsscan, eslint (security plugins), retire |
| Go | gosec, staticcheck |
| Rust | cargo-geiger (unsafe counter), clippy |
| C / C++ | cppcheck, flawfinder, clang-tidy |
| Java / JVM | semgrep (community pack) |
| PHP | psalm, phpstan (level max) |
| Ruby | brakeman |
| Shell | shellcheck (plus semgrep shell) |
| Dockerfiles | hadolint |
| YAML (CI) | semgrep p/github-actions, actionlint (if installed) |
# After all sarif files are produced in reports/:
jq -s '
{
version: "2.1.0",
runs: ( [.[].runs // []] | add )
}
' reports/sast-*.sarif > reports/sast-merged.sarif
After merge, rank findings by:
*.pb.go, *_pb2.py, *.g.dart, minified JS) → skip by
default, list exclusions at top of reports/SUMMARY.md.