skills.rest
santosomar
santosomarCOMMUNITY
Explore all skills by this author →
Website𝕏@santosomarGitHub

taint-instrumentation-assistant

Configure taint tracking sources, sinks, and sanitizers for CodeQL or Semgrep.

1|2|Updated Mar 10, 2026
Search Tags:#code analysis#security#vulnerability detection#codeql#semgrep#taint analysis
One-click install
npx skills add https://github.com/santosomar/general-secure-coding-agent-skills --skill taint-instrumentation-assistant-santosomar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: taint-instrumentation-assistant
Source: https://github.com/santosomar/general-secure-coding-agent-skills/tree/main/skills/security/taint-instrumentation-assistant
Command: npx skills add https://github.com/santosomar/general-secure-coding-agent-skills --skill taint-instrumentation-assistant-santosomar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill simplifies the setup of taint tracking for security analysis by automatically defining and configuring sources, sinks, and sanitizers based on established taxonomies.

Core Features & Use Cases

  • Automated Taint Rule Generation: Leverages Project CodeGuard's taxonomy to identify and define taint sources (e.g., user input), sinks (e.g., database queries), and sanitizers (e.g., input validation functions).
  • Tool Configuration: Translates these definitions into formats compatible with various analysis tools like CodeQL, Semgrep, or custom instrumentation.
  • Use Case: Integrate robust taint analysis into your Continuous Integration pipeline to automatically detect potential security vulnerabilities arising from untrusted data flows.

Quick Start

Configure taint analysis for a Python application using CodeQL, defining HTTP request parameters as sources and SQL queries as sinks.

Frequently Asked Questions about taint-instrumentation-assistant

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up taint tracking for security analysis in CI?▼

Taint analysis in CI is configured by defining taint sources, sinks, and sanitizers using Project CodeGuard's taxonomy, then formatting those definitions for tools like CodeQL or Semgrep to detect untrusted data flows.

What are taint sources, sinks, and sanitizers in code analysis?▼

In taint analysis, sources are untrusted data origins like HTTP requests, sinks are vulnerable execution points like database queries, and sanitizers are validation functions that clean the data before it reaches sinks.

Can I use CodeQL and Semgrep for automated vulnerability detection in my project?▼

Yes, CodeQL and Semgrep are supported for automated vulnerability detection. The system translates taint source and sink definitions into compatible formats for these tools to identify security flaws during continuous integration.

What is the best way to wire taint analysis into a Python application?▼

The best way to wire taint analysis into a Python application is to define HTTP request parameters as sources and SQL queries as sinks, then configure a tool like CodeQL to execute tracking during your CI builds.

Does this taint analysis setup require a specific source and sink catalog?▼

Yes, it requires a source and sink catalog, which is automatically provided by leveraging Project CodeGuard's input-validation taxonomy to identify and define the necessary taint tracking rules for specific languages.

Related Skills

Explore More Software Engineering Skills→
facebookfacebook
7.2k

architecture

Explain Pyre and Pysa architecture for code paths and module responsibilities.

Official
Advanced
itallstartedwithaideaitallstartedwithaidea
31

codeql-semgrep

Combine CodeQL data-flow queries and Semgrep rules to detect vulnerabilities.

Community
Advanced
PrirogativusPrirogativus

security-review

Identify and mitigate security vulnerabilities in codebases via static analysis.

Community
Advanced
rainoftimerainoftime
17

taint-analysis

Track untrusted data flow from sources to sinks in Python code.

Community
Intermediate