php-route-tracer

To trace PHP route data-flow to sinks, you provide route definitions and parameter structures as input to map the complete handler-to-sink chain. The Skill outputs a structured trace report showing parameter propagation and controllability evidence.

PHP route tracing is the process of following request handlers to final sinks such as SQL, SSRF, or XSS vectors to map parameter flow and controllability. It generates structured reports containing branch evidence and reachability analysis without making vulnerability decisions.

Yes, you can use it for PHP security audits to track how user inputs propagate through web application routes to security-relevant sinks. It provides an evidence-driven trace showing the complete data-flow chain, leaving vulnerability assessment to other tools.

To get a complete data-flow evidence chain, you provide a PHP route entry and request to trigger a trace. The system follows handlers to sinks, capturing conditional paths, exceptions, and parameter reachability to output a structured route-trace report.

No, the PHP route tracer does not determine if a data-flow path is a vulnerability. It only outputs structured trace evidence with branch paths and controllability analysis, meaning vulnerability assessment and decisions must be performed by other skills.

Generating a structured trace report requires PHP route definitions and parameter structures as input. The tracer uses these to follow handlers to sinks like template rendering or file operations, mapping the complete data-flow chain and outputting reachability evidence.