ast-taint-tracer
Provides mechanical data flow analysis for security auditing.
Install
mkdir -p .claude/skills/ast-taint-tracer && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/18015" && unzip -o skill.zip -d .claude/skills/ast-taint-tracer && rm skill.zipInstalls to .claude/skills/ast-taint-tracer
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Uses the Python AST (Abstract Syntax Tree) to map the Call Graph and trace the flow of unvalidated variables from external inputs through the layers into dangerous sinks like `session.execute` or `eval()`.Key capabilities
- →Map the Call Graph of Python code using AST
- →Trace the flow of unvalidated variables from external inputs
- →Identify dangerous sinks like `session.execute` or `eval()`
- →Flag invocations of a requested sink method
- →Trace parameters passed into a sink upstream to the function signature
How it works
The skill executes a Python AST sweep, parsing the file into a structural tree, mapping call and attribute nodes, and flagging invocations of a specified sink method. It then traces the parameters of that sink upstream to the function signature.
Inputs & outputs
When to use ast-taint-tracer
- →Audit route parameters for SQL injection
- →Trace data mutation glitches
- →Verify input validation flow
About this skill
ast-taint-tracer
Provides the Security-Auditor and Bug-Finder with mechanical Data Flow Analysis. They no longer rely on fragile text grep to trace where unvalidated variables end up.
When to use
- Security-Auditor: When you identify a fastAPI route parameter that you suspect is vulnerable to SQL injection, IDOR, or XSS.
- QA-Bug-Finder: When tracking down a weird data mutation logic glitch.
Run
bash .github/skills/ast-taint-tracer/scripts/run.sh --file "src/api/routers/devices.py" --sink "session.execute"
How it works
This executes a local Python AST sweep. It parses the file into a structural tree, maps all Call and Attribute nodes, and flags wherever the requested sink method is invoked. It then attempts to trace the parameters passed into that sink upstream to the function signature (the source).
When not to use it
- →When relying on fragile text `grep` to trace variable flow
- →When the analysis is not for Python code
Limitations
- →The analysis is specific to Python AST
- →Requires a specified sink method to trace
- →Traces parameters upstream to the function signature
How it compares
This method uses Abstract Syntax Trees for mechanical data flow analysis, providing a precise trace of variable flow, unlike text-based searches that can be fragile and less accurate.
Compared to similar skills
ast-taint-tracer side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| ast-taint-tracer (this skill) | 0 | 3mo | Review | Advanced |
| codex-code-review | 1 | 7mo | Review | Intermediate |
| netalertx-authentication-tokens | 6 | 6mo | Review | Beginner |
| dependency-auditor | 1 | 9mo | Review | Beginner |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by blazengreen360
View all by blazengreen360 →You might also like
codex-code-review
tyrchen
Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.
netalertx-authentication-tokens
netalertx
Manage and troubleshoot API tokens and authentication-related secrets. Use this when you need to find, rotate, verify, or debug authentication issues (401/403) in NetAlertX.
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
atheris
trailofbits
Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.
constant-time-analysis
trailofbits
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
cyber-audit
Matymatyk-business
Read-only exposure audit of the user's machine and projects for a CVE, breach, malicious package, or other security advisory, then write a structured report to a local audit folder. Use when the user shares a breach/CVE/malware/supply-chain advisory and asks if they're affected, says "scan my system