skills.rest
SensLiao
SensLiaoCOMMUNITY
Explore all skills by this author →
GitHub

security-app-sast-deep

Analyzes data flow from untrusted sources to dangerous sinks in backend and API code.

Updated May 28, 2026
Search Tags:#API security#security assessment#backend security#taint analysis#data flow analysis
One-click install
npx skills add https://github.com/SensLiao/Claude-code-setting --skill security-app-sast-deep
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-app-sast-deep
Source: https://github.com/SensLiao/Claude-code-setting/tree/main/skills/security-app-sast-deep
Command: npx skills add https://github.com/SensLiao/Claude-code-setting --skill security-app-sast-deep

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires semgrep, joern, codeql, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill performs deep taint analysis on backend and API code, tracing untrusted sources to dangerous sinks across functions and files, identifying potential security vulnerabilities.

Core Features & Use Cases

  • Deep Taint Analysis: Traces data flow from untrusted sources to dangerous sinks across functions and files.
  • Decision Tree: Selects the appropriate analysis tool based on project type (open-source or closed-source).
  • Source to Sink Modeling: Identifies potential vulnerabilities by mapping data flow paths.
  • Integration: Integrates with other security tools for a comprehensive security analysis.

Quick Start

Run the security-app-sast-deep skill on your codebase to identify potential security vulnerabilities.

Frequently Asked Questions about security-app-sast-deep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is deep taint analysis for backend and API code?▼

Deep taint analysis for backend and API code traces untrusted data flow from sources to dangerous sinks across functions and files to identify potential security vulnerabilities. It models data paths to detect injection risks.

How do I perform taint analysis on a closed-source backend project?▼

To perform taint analysis on a closed-source project, this Skill uses a decision tree to select an appropriate analysis tool. It supports analyzing both open-source and closed-source codebases to map data flow.

Can I use Semgrep, Joern, and CodeQL together for API security assessment?▼

Yes, you can use Semgrep, Joern, and CodeQL for API security assessment. The Skill integrates with these security tools to provide a comprehensive analysis of data flow and potential vulnerabilities.

How does source to sink modeling identify security vulnerabilities?▼

Source to sink modeling identifies security vulnerabilities by mapping data flow paths from untrusted sources to dangerous sinks. It traces this data across functions and files to expose potential backend security flaws.

Related Skills

Explore More Software Engineering Skills→
h4vzzh4vzz
33

static-application-security-testing

Scan source code for security vulnerabilities and generate SARIF reports.

Community
Advanced
n4igmen4igme

sc4-validate

Trace data flows across files to validate vulnerability findings and generate remediation reports.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

pentest-cicd-redteam

Automates security assessments and red teaming in CI/CD pipelines via GitHub Actions, GitLab CI, Jenkins, and scanning tools.

Community
Advanced
dreadnodedreadnode
11

vuln-kb

Map security testing signals to CWE vulnerability references and test strategies.

Official
Intermediate