skills.rest
Q16G
Q16GCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dataflow-analysis

Analyze cross-function taint propagation with SyntaxFlow MCP and deterministic fallback.

83|8|Updated May 6, 2026
Search Tags:#mcp#ssa#code-audit#dataflow#security-analysis#taint-analysis#syntaxflow
One-click install
npx skills add https://github.com/Q16G/aster --skill dataflow-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dataflow-analysis
Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/dataflow-analysis
Command: npx skills add https://github.com/Q16G/aster --skill dataflow-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dataflow Analysis with taint tracking to confirm cross-function source-to-sink data flows for SAST candidates, validating whether taint propagation paths are realistically reachable. It supports SSA-based analysis via SyntaxFlow and a deterministic manual fallback.

Core Features & Use Cases

  • SSA-based dataflow analysis with top-def/bottom-use tracing when SyntaxFlow MCP is available
  • Deterministic fallback checklist when SyntaxFlow is unavailable
  • Multilanguage support for Java, Go, Python, JavaScript, PHP, and C
  • Structured results including sources, sinks, and entry points for audit
  • Flexible integration with MCP to inject tool contexts as needed

Quick Start

Provide a target_path and optional language to run dataflow-analysis and validate cross-function taint propagation.

Frequently Asked Questions about dataflow-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify cross-function taint propagation for SAST candidates in my codebase?▼

Cross-function taint propagation is verified by analyzing source-to-sink data flows using SSA-based tracing or a deterministic fallback. This confirms whether taint paths are realistically reachable across function boundaries in your codebase.

Can I perform dataflow analysis on multiple programming languages like Java, Go, and Python?▼

Dataflow analysis supports Java, Go, Python, JavaScript, PHP, and C. It applies SSA-based analysis or a deterministic manual fallback to validate cross-function taint propagation across these different codebases.

Do I need the SyntaxFlow MCP server to run cross-function dataflow analysis?▼

You do not need the SyntaxFlow MCP server to run cross-function dataflow analysis. When SyntaxFlow is unavailable, the tool applies a deterministic manual fallback checklist to validate source-to-sink taint flows.

What structured results does cross-function taint analysis produce for code audits?▼

Cross-function taint analysis produces structured results including entry points, sources, sinks, and a status of Confirmed, Needs Review, or False Positive. It also provides guidance for remediating identified security vulnerabilities.

How do I start validating source-to-sink data flows using SSA-based analysis?▼

To start validating source-to-sink data flows, provide a target_path and an optional language parameter. This triggers dataflow-analysis to trace top-def and bottom-use patterns via SyntaxFlow MCP when available.

What are the limitations of using a deterministic fallback for dataflow analysis?▼

The deterministic fallback for dataflow analysis lacks the automated top-def and bottom-use tracing available with SSA-based SyntaxFlow integration. It relies on a manual checklist to evaluate cross-function taint propagation rather than dynamic tool context injection.

Related Skills

Explore More Software Engineering Skills→
nesnilnehcnesnilnehc
7

review-powershell

Identify language and runtime conformance issues in PowerShell code.

Community
Advanced
vanillacake369vanillacake369
2

security-review

Identify security vulnerabilities in codebases with prioritized remediation guidance.

Community
Basic
whtoowhtoo
34

compiler-dev

Automate compiler backend tasks for IR, CFG, SSA, and optimization passes.

Community
Advanced
santosomarsantosomar
1

taint-instrumentation-assistant

Configure taint tracking sources, sinks, and sanitizers for CodeQL or Semgrep.

Community
Intermediate