skills.rest
jd-opensource
jd-opensourceOFFICIAL
Explore all skills by this author →
WebsiteGitHub

pentest-whitebox-code-review

Traces dangerous sinks to user-controlled sources via backward taint analysis.

299|56|Updated Jan 13, 2026
Search Tags:#authentication#xss#security-review#taint-analysis#whitebox#exploitation-queue
One-click install
npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-whitebox-code-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentest-whitebox-code-review
Source: https://github.com/jd-opensource/JoySafeter/tree/main/skills/pentest-whitebox-code-review
Command: npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-whitebox-code-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Source code security audit using backward taint analysis, slot type classification, render context verification, and 3-phase parallel review producing an exploitation queue.

Core Features & Use Cases

  • Backward taint analysis tracing dangerous sinks to user-controlled sources.
  • Slot type classification (SQL-val, SQL-ident, CMD-argument, FILE-path, TEMPLATE-expr) to identify risky patterns.
  • Render context verification for XSS protection across HTML_BODY, HTML_ATTRIBUTE, JAVASCRIPT_STRING, URL_PARAM, CSS_VALUE.
  • 3-phase workflow with discovery, vulnerability analysis across multiple tracks, and synthesis to produce a prioritized exploitation queue.
  • Automated generation of exploitation queue JSON for downstream validation.

Quick Start

Run the white-box code review workflow on your target repository to produce a prioritized exploitation queue for validation.

Frequently Asked Questions about pentest-whitebox-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does backward taint analysis find security vulnerabilities in source code?▼

Backward taint analysis traces dangerous sinks back to user-controlled sources to identify injection points. It classifies slot types like SQL-val and CMD-argument to verify risky patterns and generate a prioritized exploitation queue.

Can I use this whitebox code review tool for multi-language web and mobile backends?▼

Yes, this whitebox code review applies to multi-language codebases and modern web/mobile backends. It identifies injection points, XSS contexts, and authorization issues across diverse backend architectures.

How do I perform automated XSS detection across different render contexts?▼

Render context verification checks XSS protection across HTML_BODY, HTML_ATTRIBUTE, JAVASCRIPT_STRING, URL_PARAM, and CSS_VALUE. This automated process evaluates how user-controlled data renders to identify exploitability.

What is an exploitation queue in automated security review?▼

An exploitation queue is a prioritized list of identified vulnerabilities with confidence scoring. It is generated through a 3-phase parallel review workflow to guide downstream validation of security issues.

What slot types are classified during a whitebox security review?▼

Slot type classification identifies risky patterns by categorizing data into SQL-val, SQL-ident, CMD-argument, FILE-path, and TEMPLATE-expr. This determines how user-controlled sources interact with dangerous execution sinks.

Related Skills

Explore More Software Engineering Skills→
santosomarsantosomar
1

taint-instrumentation-assistant

Configure taint tracking sources, sinks, and sanitizers for CodeQL or Semgrep.

Community
Intermediate
infantesromeroadrianinfantesromeroadrian

transilience-injection

Detect and exploit SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection vulnerabilities.

Community
Advanced
RooseveltAdvisorsRooseveltAdvisors
1

WebAssessment

Automate web application security assessments and generate prioritized penetration testing plans.

Community
Advanced
rohanbhatia27rohanbhatia27
1

c-review

Identifies security vulnerabilities in C/C++ applications via automated analysis.

Community
Advanced