← ClaudeAtlas

dataflow-analysislisted

Track data flow between function parameters, calls, and arguments using taint analysis. Use when detecting vulnerabilities like command injection, buffer overflows, or tracing user input to dangerous functions.
vulhunt-re/skills · ★ 15 · Data & Documents · score 63
Install: claude install-skill vulhunt-re/skills
# Dataflow Analysis Perform intra-procedural dataflow analysis to track how data flows within functions. ## When to use - Track if a function parameter flows to a function call argument - Track if a function call's output flows to another function call's argument - Find taint propagation paths (e.g., user input reaching dangerous functions) - Detect vulnerabilities like command injection, buffer overflows ## Instructions Using the VulHunt MCP tools, open the project (`open_project`) and run the following Lua query (`query_project`). To perform dataflow analysis, use `project:calls_matching{}`: ```lua local calls = project:calls_matching({ to = <target_call>, where = function(caller) return caller:named("<function_name>") and caller:has_call(<target_call>) end, using = { -- Annotate caller parameters parameters = {var:named "first_param", _}, -- Annotate callees callees = { ["malloc"] = {inputs = {var:named "size"}}, ["strlen"] = {output = var:named "len", inputs = {_}}, ["check_len"] = {inputs = {var:sanitised()}} } } }) local results = {} for _, c in ipairs(calls) do local entry = { caller_name = c.caller.name, call_address = c.call_address, } if c.inputs[1] and c.inputs[1].annotation then entry.arg1_annotation = c.inputs[1].annotation entry.arg1_source = c.inputs[1].origin.source_address end if c.inputs[2] and c.inputs[2].annotation then entry.arg2_annotation = c.inputs[2].annotatio