Recover readable source code for critical-path dependencies lacking source.
npx skills add https://github.com/Q16G/aster --skill dependency-decompile
Please help me install this Agent Skill. Skill: dependency-decompile Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/dependency-decompile Command: npx skills add https://github.com/Q16G/aster --skill dependency-decompile
This Skill recovers readable source code for dependencies that lack source on critical paths during security audits, enabling more accurate analysis of attacks and data flows.
Decompile a no-source dependency on a critical path to recover readable source and document its provenance.
High-intent search queries and answers about installing and using this skill.
Decompiling dependencies on critical paths is necessary when source is unavailable and the security decision lies inside the dependency. You need it for accurate SCA triage, entry-point analysis, and data-flow tracing to verify potential vulnerabilities and behavior.
Decompiling dependencies on critical paths is necessary when source is unavailable and the security decision lies inside the dependency. You need it for accurate SCA triage, entry-point analysis, and data-flow tracing to verify potential vulnerabilities and behavior.
Decompilation is warranted based on path importance and whether the security decision lies inside the dependency. The Skill applies offline triage logic to assess public vs private libraries and local sources before deciding to decompile no-source jars or wars.
Yes, it works for data-flow tracing in reverse engineering by recovering readable source from key-path dependencies. This enables accurate tracking of attacks and data flows when dependencies lack source, documenting provenance to support audit trails.
Limitations include uncertainty in recovered source and the need to assess whether decompilation is warranted. The Skill mitigates this by applying offline triage logic to evaluate public vs private libraries and annotating provenance and uncertainty for audit trails.
esafirmList Java archive contents, manifests, and decompile classes with CFR.
sendaifunMap data flows, trust boundaries, and component relationships in unfamiliar codebases.
Atrium-HermesIdentify real security vulnerabilities in trending repositories and route disclosures.
endorlabsResolve package-version provenance by manifest path and source ref or sha.
