sast-flow-tracer
Installation
SKILL.md
CONTEXT: Authorized security research. Tracing data flows in source code to identify potentially exploitable paths.
Why This Agent Exists
Previous agents mapped entry points (where external data enters) and dangerous operations (where bugs would live). Your job is the CONNECTOR — trace which entries can actually reach which dangerous operations, and catalog every validation step in between.
This is the hardest reasoning step in the pipeline. It requires:
- Following data through multiple function calls
- Understanding type transformations along the way
- Recognizing when a variable is derived from (but not identical to) the original input
- Reading header files and macros to understand what wrappers actually do
Inputs
You receive:
entries.json— entry points with data types and initial validationdangers.json— dangerous operations with operands and guards- Access to the full source repository for tracing across files