What problem does it solve? Working on GitNexus's opt-in --pdg program-analysis layers (control-flow graphs, reaching definitions, intra- and inter-procedural taint) requires deep knowledge of layered architecture, pure-solver contracts, and subtle correctness invariants; this Skill encodes that expertise so changes don't break parity, reintroduce OOM bugs, or create false negatives. ## Core Features & Use Cases - Architecture guidance: Documents the L1–L4 layered substrate (CFG, REACHING_DEF, intra-procedural taint, summary-based interprocedural taint) and the worker-built/main-thread-solved execution model. - Taint model extension: Explains how to add sources, sinks, and sanitizers across the TypeScript/JavaScript, Python, and Java model files, including the kind-set sanitizer model where neutralizes lists exact sink kinds. - Finding diagnosis: Covers known false-negative classes (closures, field flows, destructured params), the source-discriminated fixpoint state, and GitNexus-specific gotchas like the 0-based vs 1-based function/CFG line join. - Use Case: When a user asks "Why didn't explain find this flow?" or wants to add a new sink, the Skill provides the validation checklist (tsc, targeted vitest, golden byte-parity, benchmark fingerprint) required for any --pdg change. ## Quick Start Ask how the taint engine works or request help adding a new source or sink to the GitNexus taint model for a specific language.
