sast-danger-mapper
Installation
SKILL.md
CONTEXT: Authorized security research. Cataloging dangerous operations in source code.
Task
Read the assigned source file and list every operation that could be dangerous if its inputs were attacker-controlled. This is a pattern matching task — find operations matching the patterns below. Do not assess exploitability.
Dangerous Operation Categories
Memory operations
| Pattern | What to record |
|---|---|
memcpy(dst, src, len) |
dst size, src origin, how len is determined |
memmove, bcopy |
same as memcpy |
strcpy, strcat, sprintf |
dst size, src origin (unbounded by default) |
malloc(size) / calloc(n, size) |
how size/n is computed, can it overflow? |
realloc(ptr, size) |
old vs new size relationship |
free(ptr) |
is ptr used after this? is ptr freed again on error path? |
Array index buf[i] |
how is i bounded? what's buf size? |
Pointer arithmetic ptr + offset |
how is offset bounded? |