taint-analysis

Trace attacker-controlled inputs to sinks and origins across module boundaries.

17|3|Updated Feb 22, 2026

Search Tags:#security #vulnerability #data-flow #taint #cross-module #taint-analysis

Ready to run

npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill taint-analysis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: taint-analysis
Source: https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/taint-analysis
Command: npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill taint-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Taint-analysis helps security researchers identify how attacker-controlled inputs propagate through software, exposing dangerous sinks, bypassable guards, and cross-module attack chains.

Core Features & Use Cases

Forward taint tracing to sinks (e.g., CreateProcess, WriteFile) and mapping of tainted paths.
Backward origin analysis to discover caller origins and taint sources.
Cross-module taint propagation with parameter mapping, trust boundary classification, and COM/RPC boundary handling.

Quick Start

Run taint analysis on a target function to trace tainted arguments to sinks and trace origins across module boundaries.

Frequently Asked Questions about taint-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I trace attacker-controlled inputs to dangerous sinks?▼

To trace attacker-controlled inputs to dangerous sinks, apply forward taint analysis to map tainted execution paths from a target function to APIs like CreateProcess or WriteFile, exposing potential vulnerabilities.

What is cross-module taint propagation and how does it handle trust boundaries?▼

Cross-module taint propagation tracks attacker-controlled data across module boundaries using parameter mapping. It classifies trust boundaries and handles COM/RPC boundaries to uncover complex attack chains.

How do I find the origins of tainted data backwards across modules?▼

To find the origins of tainted data, use backward origin analysis to trace caller origins and taint sources back across module boundaries, identifying where attacker-controlled inputs initially entered the execution flow.

Do I need module analysis databases to perform cross-module taint analysis?▼

Yes, cross-module taint analysis requires module analysis databases to map parameter propagation and classify trust boundaries effectively. You also need Python 3.10+ and internal helper modules for API taxonomy and guard classification.

What's the best way to identify bypassable guards in data-flow security analysis?▼

To identify bypassable guards in data-flow security analysis, perform taint tracing from attacker-controlled inputs to sinks while leveraging guard classification to detect insufficient security checks along the tainted execution paths.