Data Flow Tracing

Trace data from input sources to security-sensitive sinks in application codebases.

22|3|Updated Feb 23, 2026

Search Tags:#code analysis #data flow #pentesting #vulnerability research #taint analysis #source to sink

Ready to run

npx skills add https://github.com/allsmog/vuln-scout --skill data-flow-tracing

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Data Flow Tracing
Source: https://github.com/allsmog/vuln-scout/tree/main/whitebox-pentest/skills/data-flow-tracing
Command: npx skills add https://github.com/allsmog/vuln-scout --skill data-flow-tracing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security professionals understand how user-controlled data moves through an application, which is critical for identifying and confirming vulnerabilities.

Core Features & Use Cases

Source Identification: Pinpoints where external input enters the application (e.g., HTTP requests, database reads).
Sink Identification: Locates security-sensitive functions where data could be misused (e.g., command execution, SQL queries).
Data Transformation Tracking: Documents how data is modified, encoded, or filtered between source and sink.
Use Case: A developer suspects that user input might be used in a system command. This skill guides them to trace that input from the web request parameters all the way to the system() function, verifying if it's controllable and exploitable.

Quick Start

Use the data flow tracing skill to follow user input from the $_GET parameter to the exec function in the provided PHP code.

Frequently Asked Questions about Data Flow Tracing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I trace user-controlled data from an input source to a security-sensitive sink?▼

To trace user-controlled data from source to sink, you need to map data transformations throughout the application codebase, tracking how external inputs like HTTP requests are modified, encoded, or filtered before reaching sensitive functions like command execution or SQL queries.

What is taint analysis in the context of whitebox penetration testing?▼

Taint analysis in whitebox penetration testing is the process of tracking user-controlled data from input sources to security-sensitive sinks to identify potential vulnerabilities like command injection or SQL injection by verifying if the data remains exploitable.

How do I identify potential command injection vulnerabilities in application code?▼

To identify potential command injection vulnerabilities, trace user input from web request parameters to system command execution functions, verifying if the data is controllable and exploitable by mapping data transformations and checking for adequate sanitization techniques.

Can I use data flow tracing to find SQL injection vulnerabilities across multiple programming languages?▼

Yes, you can use data flow tracing to find SQL injection vulnerabilities across multiple programming languages by locating security-sensitive SQL query sinks, identifying external input sources, and verifying if the data flow lacks proper sanitization before reaching the database query.

What sources and sinks should I look for when tracing data flow for vulnerability research?▼

When tracing data flow for vulnerability research, look for external input sources like HTTP requests and database reads, and track them to security-sensitive sinks such as command execution functions and SQL queries to verify if the data is controllable and exploitable.

Do I need to understand data sanitization techniques to perform source to sink analysis?▼

Yes, you need to understand common data sanitization techniques across multiple programming languages to perform source to sink analysis, as tracking how data is modified, encoded, or filtered between the source and sink is critical for confirming if a vulnerability is exploitable.