메뉴
Run an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Model a library method's taint propagation as a passThrough approximation config. Use for a dropped external method whose propagation is simple copying
Author and verify an OpenTaint detection rule for a vulnerability class on JVM code. Use whenever a rule needs to be created for an uncovered vulnerability, or an existing rule needs a false-positive or false-negative fix
Create an OpenTaint test project with annotated positive/negative samples for verifying a rule or approximation. Use when a rule or approximation needs a test project to check against
Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped. Use when its samples won't pass after repeated attempts, or it passes tests but is wrong on a real scan
Write an OpenTaint engine-issue report from a confirmed diagnosis, optionally opening a GitHub issue. Use when engine-side issue got confirmed and requires report
Mark which of a project's dependency libraries could introduce taint sources or sinks. Use to start attack-surface discovery
| name | run-scan |
| description | Run an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project |
| license | Apache-2.0 |
| metadata | {"author":"opentaint","version":"0.2"} |
Run an OpenTaint scan over a project and collect results
From the caller; if omitted, fall back to the default. Ask only when a required input is missing and has no sensible default
<model-dir> / <project-src> — pre-compiled model or source project directory. Default: model at .opentaint/project<rules-dir> — Default: builtin plus .opentaint/rules if present<full-id> (optional) — full IDs to restrict the scan to, omit to run all loaded rules<report.sarif> — Default: .opentaint/results/report.sarif<config-dir> (optional) — a passThrough YAML file or a directory of them. Default: .opentaint/pass-through<approx-dir> (optional) — Default: .opentaint/dataflowPoint at the code either way: a source project (CLI compiles it) as the positional scan <project-src>, or a pre-built model via --project-model <model-dir>. If project model provided prefer using it instead of source project
opentaint scan --project-model <model-dir> \
-o <report.sarif> \
--ruleset builtin --ruleset <rules-dir> \
--track-external-methods
Append optional flags as needed:
--rule-id <full-id> — restrict to specific rules (repeatable); omit to run all loaded rules--passthrough-approximations <config-dir> — apply passThrough configs from a YAML file or a directory of them (OVERRIDE: merged with built-ins at the rule level, a provided rule overrides a built-in only when it matches one; repeatable)--dataflow-approximations <approx-dir> — apply code-based approximations (Java sources, auto-compiled; or pre-compiled .class dirs, passed through as-is)Three files, all next to the SARIF report:
<report.sarif> — findings with code-flow tracesdropped-external-methods.yaml — methods where dataflow facts were killed (no approximation model) → candidates to approximate; possible source of false negativesapproximated-external-methods.yaml — methods already modeled| Flag | Purpose |
|---|---|
--project-model | Pre-compiled model directory (omit to scan a source project via the positional arg) |
--ruleset | Rule directory (repeatable); builtin for built-ins |
--rule-id | Restrict to specific full rule IDs (repeatable) |
--passthrough-approximations | passThrough configs: a YAML file or directory of them (OVERRIDE, repeatable) |
--dataflow-approximations | Directory of Java sources or compiled classes (repeatable) |
--track-external-methods | Emit dropped-external-methods.yaml + approximated-external-methods.yaml next to the SARIF |
--timeout | Analysis timeout (default 900s) |
.opentaint/ layout when the caller omits them; the caller can override any of them