vulnerability-analysis

name	vulnerability-analysis
description	Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
metadata	{"type":"offensive","phase":"analysis","tools":"codeql, semgrep, joern, opengrep, trufflehog, gitleaks, kingfisher, osv-scanner, syft, grype, trivy, npm-audit, pip-audit, ysoserial, phpggc","mitre":["T1190","T1059","T1552.001","T1195.001","T1213"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0002","TA0001"],"attck_techniques":["T1190","T1059","T1552.001","T1195.001","T1195.002"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest"]
inputs	["attack_surface_map","source_code"]
outputs	["vulnerability_list","taint_analysis_report","finding_record","sbom"]
references	["references/taint-engines-static-analysis.md","references/injection-source-patterns.md","references/memory-safety-c-cpp.md","references/deserialization-prototype-pollution.md","references/secrets-crypto-authz-concurrency.md","references/supply-chain-dependency-audit.md","references/variant-hunting.md"]
scripts	["scripts/taint_trace.py","scripts/sast_runner.py","scripts/joern_taint.sc","scripts/deser_gadget_scan.py","scripts/secret_crypto_audit.py","scripts/dep_audit.py","scripts/validate_findings.py","scripts/evidence_kit.py","scripts/variant_hunt.py","scripts/path_conditions.py","scripts/merge_runtime_evidence.py"]

Vulnerability Analysis

Every vulnerability you miss is one an attacker finds first. Systematic source auditing traces untrusted data from source to sink, evaluates every sanitizer for bypass, and questions each trust-boundary assumption. This skill is the router; depth lives in references/, and every technique cluster is backed by a runnable tool in scripts/.

When to Activate

• Auditing any codebase (white/grey box) for security vulnerabilities
• Writing/driving CodeQL queries, Semgrep taint rules, or Joern CPGQL flows
• Tracing injection, deserialization, prototype-pollution, or memory-safety paths
• Reviewing auth/authorization (IDOR/BOLA), cryptography, or concurrency (TOCTOU)
• Triaging dependency CVEs and hunting malicious/compromised packages (SCA)
• Variant hunting — generalizing one finding into a codebase-wide pattern

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Taint analysis (source/sink/sanitizer modeling)	T1190	CWE-20	references/taint-engines-static-analysis.md	scripts/taint_trace.py
CodeQL/Semgrep/Joern engine orchestration + merge	T1190	CWE-20	references/taint-engines-static-analysis.md	scripts/sast_runner.py, scripts/joern_taint.sc
SQL injection (raw/ORM/identifier/2nd-order/NoSQL)	T1190	CWE-89	references/injection-source-patterns.md	scripts/taint_trace.py
OS command / argument injection	T1059	CWE-78 / CWE-88	references/injection-source-patterns.md	scripts/taint_trace.py
Server-side template injection	T1190	CWE-1336	references/injection-source-patterns.md	scripts/taint_trace.py
Path traversal	T1083	CWE-22	references/injection-source-patterns.md	scripts/taint_trace.py
SSRF (tainted server-side URL)	T1190	CWE-918	references/injection-source-patterns.md	scripts/taint_trace.py
Integer overflow -> heap/stack overflow