Skill: Assemble Lib Rules

Reusable source rules share the single untrusted-data-source tag. Write only the security joins that connect it to sink tags reported as uncovered by get_status.py. An existing join automatically includes every new library rule carrying either tag. The main scan verifies the joins.

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

• project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
• language (required) — target language for this project and language-specific instructions

Workflow

1. Get the missing sink tags

The orchestrator dispatches this skill only when get_status.py reports uncovered joins. Use that output as the complete worklist: each untrusted-data-source -> sink-tag line under reusable tag groups are not fully joined names one sink tag to connect. The script has already accounted for active built-in and custom library rules and for existing joins. Do not read those rules or recompute the matrix yourself.

2. Write one security join per missing sink tag