Trace dependency sinks from app entry points to determine reachability.
npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill reachability
Please help me install this Agent Skill. Skill: reachability Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/reachability Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill reachability
This skill helps teams verify whether known library sinks from a project's dependencies are reachable from the application's trust boundaries, enabling safer exposure of dependencies.
Run reachability to trace each library sink from the app entry points and report which are reachable.
High-intent search queries and answers about installing and using this skill.
Dependency reachability analysis traces known library sinks from an application's trust boundaries to determine if external inputs can reach vulnerable dependency calls. It generates a structured report highlighting reachable sinks, risk levels, and ruled-out items.
You can trace vulnerable dependency sinks by running a reachability analysis on applications with a dependency graph and entry points, such as projects with Gemfile.lock or package-lock.json, to map each sink from the app to the library call.
Yes, reachability analysis is designed for applications with Gemfile.lock or package-lock.json files. It consumes dependency graphs and entry points from these manifests to trace library sinks to the application's trust boundaries.
Scrutineer findings must include candidate sinks with fields like package, ecosystem, requirement, manifest_path, dependency_type, severity, cwe, title, location, sinks, trace, and boundary to perform the reachability trace.
Static analysis determines library sink reachability by tracing each sink from the application's entry points through the dependency graph to the corresponding library call, verifying whether potentially dangerous sinks are properly isolated from external inputs.
A reachability findings report includes an organized inventory highlighting reachable sinks and their risk levels, along with structured ruled-out items, conforming to a given schema to help teams validate dependency isolation.
luansilvadbTrace untrusted input from sources to sinks to identify injection vulnerabilities.
endorlabsCompare dependency graphs and function callpaths to produce reachability verdicts.
manuelbrandner85Parse source code into directed graphs for security-focused static analysis.
endorlabsCompare GitHub repository inventory with Endor project details to identify monitored-branch coverage gaps.
