vulnerability-analysis

# Vulnerability Analysis Every vulnerability you miss is one an attacker finds first. Systematic source auditing traces untrusted data from **source** to **sink**, evaluates every sanitizer for bypass, and questions each trust-boundary assumption. This skill is the router; depth lives in `references/`, and every technique cluster is backed by a runnable tool in `scripts/`. ## When to Activate - Auditing any codebase (white/grey box) for security vulnerabilities - Writing/driving CodeQL queries, Semgrep taint rules, or Joern CPGQL flows - Tracing injection, deserialization, prototype-pollution, or memory-safety paths - Reviewing auth/authorization (IDOR/BOLA), cryptography, or concurrency (TOCTOU) - Triaging dependency CVEs and hunting malicious/compromised packages (SCA) - Variant hunting — generalizing one finding into a codebase-wide pattern ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Taint analysis (source/sink/sanitizer modeling) | T1190 | CWE-20 | references/taint-engines-static-analysis.md | scripts/taint_trace.py | | CodeQL/Semgrep/Joern engine orchestration + merge | T1190 | CWE-20 | references/taint-engines-static-analysis.md | scripts/sast_runner.py, scripts/joern_taint.sc | | SQL injection (raw/ORM/identifier/2nd-order/NoSQL) | T1190 | CWE-89 | references/injection-source-patterns.md | scripts/taint_trace.py | | OS command / argument injection | T1059 | CWE-78 / CWE-88 | references/inje...