vulnerability-analysis
starsforks
How to install vulnerability-analysis?
hypnguyen1209/offensive-claude/vulnerability-analysis
$npx -y skills add hypnguyen1209/offensive-claude --skill vulnerability-analysisUse when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
SKILL.md
| 1 | # Vulnerability Analysis |
| 2 | |
| 3 | Every vulnerability you miss is one an attacker finds first. Systematic source |
| 4 | auditing traces untrusted data from **source** to **sink**, evaluates every |
| 5 | sanitizer for bypass, and questions each trust-boundary assumption. This skill is |
| 6 | the router; depth lives in `references/`, and every technique cluster is backed |
| 7 | by a runnable tool in `scripts/`. |
| 8 | |
| 9 | ## When to Activate |
| 10 | |
| 11 | - Auditing any codebase (white/grey box) for security vulnerabilities |
| 12 | - Writing/driving CodeQL queries, Semgrep taint rules, or Joern CPGQL flows |
| 13 | - Tracing injection, deserialization, prototype-pollution, or memory-safety paths |
| 14 | - Reviewing auth/authorization (IDOR/BOLA), cryptography, or concurrency (TOCTOU) |
| 15 | - Triaging dependency CVEs and hunting malicious/compromised packages (SCA) |
| 16 | - Variant hunting — generalizing one finding into a codebase-wide pattern |
| 17 | |
| 18 | ## Technique Map |
| 19 | |
| 20 | | Technique | ATT&CK | CWE | Reference | Script | |
| 21 | |-----------|--------|-----|-----------|--------| |
| 22 | | Taint analysis (source/sink/sanitizer modeling) | T1190 | CWE-20 | references/taint-engines-static-analysis.md | scripts/taint_trace.py | |
| 23 | | CodeQL/Semgrep/Joern engine orchestration + merge | T1190 | CWE-20 | references/taint-engines-static-analysis.md | scripts/sast_runner.py, scripts/joern_taint.sc | |
| 24 | | SQL injection (raw/ORM/identifier/2nd-order/NoSQL) | T1190 | CWE-89 | references/injection-source-patterns.md | scripts/taint_trace.py | |
| 25 | | OS command / argument injection | T1059 | CWE-78 / CWE-88 | references/injection-source-patterns.md | scripts/taint_trace.py | |
| 26 | | Server-side template injection | T1190 | CWE-1336 | references/injection-source-patterns.md | scripts/taint_trace.py | |
| 27 | | Path traversal | T1083 | CWE-22 | references/injection-source-patterns.md | scripts/taint_trace.py | |
| 28 | | SSRF (tainted server-side URL) | T1190 | CWE-918 | references/injection-source-patterns.md | scripts/taint_trace.py | |
| 29 | | Integer overflow -> heap/stack overflow | T1203 | CWE-190 / CWE-787 | references/memory-safety-c-cpp.md | scripts/joern_taint.sc | |
| 30 | | Use-after-free / double-free | T1203 | CWE-416 / CWE-415 | references/memory-safety-c-cpp.md | scripts/joern_taint.sc | |
| 31 | | Unbounded copy / NULL deref | T1203 | CWE-120 / CWE-476 | references/memory-safety-c-cpp.md | scripts/joern_taint.sc | |
| 32 | | Insecure deserialization + gadget preconditions | T1059 | CWE-502 | references/deserialization-prototype-pollution.md | scripts/deser_gadget_scan.py | |
| 33 | | Prototype pollution -> gadget -> RCE | T1059.007 | CWE-1321 | references/deserialization-prototype-pollution.md | scripts/deser_gadget_scan.py | |
| 34 | | Hardcoded secrets / high-entropy literals | T1552.001 | CWE-798 / CWE-321 | references/secrets-crypto-authz-concurrency.md | scripts/secret_crypto_audit.py | |
| 35 | | Weak / misused cryptography | T1600 | CWE-327 / CWE-328 / CWE-330 / CWE-347 | references/secrets-crypto-authz-concurrency.md | scripts/secret_crypto_audit.py | |
| 36 | | Broken authorization / IDOR / BOLA | T1190 | CWE-639 / CWE-862 | references/secrets-crypto-authz-concurrency.md | scripts/secret_crypto_audit.py | |
| 37 | | TOCTOU / race condition | T1190 | CWE-367 / CWE-362 | references/secrets-crypto-authz-concurrency.md | scripts/secret_crypto_audit.py | |
| 38 | | Known-CVE dependency (SCA) | T1195.001 | CWE-1395 / CWE-1104 | references/supply-chain-dependency-audit.md | scripts/dep_audit.py | |
| 39 | | Malicious package / install worm / typosquat | T1195.002 | CWE-506 / CWE-829 / CWE-1357 | references/supply-chain-dependen |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
