Map user-controlled data to dangerous sinks and write RCE findings to rce-results.md.
npx skills add https://github.com/utkusen/sast-skills --skill sast-rce
Please help me install this Agent Skill. Skill: sast-rce Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-rce Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-rce
Quickly identify and prioritize Remote Code Execution vulnerabilities in a codebase by mapping dangerous sinks to tainted inputs and producing a structured risk report.
Run the RCE assessment on your project to generate a sink map and consolidated findings.
High-intent search queries and answers about installing and using this skill.
To identify remote code execution vulnerabilities, you can run an assessment that maps dangerous sinks to tainted user inputs. This process traces user-controlled data through the codebase to validate taint paths and generates a consolidated risk report.
Taint tracking detects unsafe sinks by mapping how user-controlled data propagates through the application to dangerous endpoints. It validates these data flows to confirm if malicious input can reach OS command execution, eval functions, or unsafe deserialization patterns.
You can triage RCE risks across a project using a three-phase workflow: recon to locate sinks, batched verify to validate taint paths, and merge to consolidate findings. This produces a structured rce-results.md report for remediation.
Yes, you need a sast/architecture.md file to exist before scanning for RCE vulnerabilities. The analysis uses this architecture context to understand the codebase structure and writes the final consolidated findings to sast/rce-results.md.
RCE security assessments cover several dangerous sink types including OS command execution, eval-like dynamic code execution, and unsafe deserialization patterns. These sinks are targeted across multiple programming languages to map potential exploit paths.
Using a batched verify approach for taint tracking isolates and validates specific data flow paths to reduce false positives. It confirms that untrusted input actually reaches dangerous sinks before merging results into the final risk report.
utkusenDetect Cross-Site Scripting vulnerabilities by tracing user input through rendering sinks.
utkusenDetect unsafe GraphQL operation document construction with user input tracing.
seb1nRun SAST scans with Semgrep and CodeQL to detect vulnerabilities in source code.
giosuetedeschi-specIdentify and validate HTML injection vulnerabilities in web application inputs.
