Skill: Create Approximation

Create code-based approximations for complex library methods involving lambdas, async, or callbacks.

When approximations are actually useful

Approximations (both code-based and YAML) only change the analysis of external methods with no existing model. Concretely, this means the method the approximation targets must appear in <sarif-dir>/external-methods-without-rules.yaml produced by the previous scan (see analyze-findings skill). An entry there means the analyzer walked through that method and killed the dataflow facts because it had no rule — that's the exact gap you can fill.

If the method is in external-methods-with-rules.yaml, it is already modeled. Writing another approximation for it is a no-op at best and conflicts with a built-in rule at worst (duplicate-target error). Skip it.

If the method is in neither list, the analyzer never reached it on a tainted path during the scan. Adding an approximation will not change the result until the analyzer actually observes a tainted argument flowing in.