What happens if the code doesn't compile?

Call graph analysis requires a valid Go workspace. If the project has compilation errors, the skill will report that it cannot build the graph and suggest fixing those errors first.

How does this differ from govulncheck?

While it serves a similar purpose, this skill provides granular control over the analysis algorithm, produces visual call chains (DOT/SVG), and can analyze specific functions even if govulncheck doesn't have the specific CVE data.

Do I need to install external tools to use this skill?

Yes, it requires the Go callgraph and digraph utilities. For visual graph generation (SVG), Graphviz is also recommended.

What algorithms does this skill use for analysis?

It defaults to Variable Type Analysis (VTA) for high precision but supports Rapid Type Analysis (RTA) and Class Hierarchy Analysis (CHA) as faster fallbacks for large codebases.

Can it analyze web handlers or test files?

Yes, the skill searches for paths from several entry points including main(), init functions, and test entry points to ensure comprehensive reachability checking.

Go Call Graph Reachability Analysis

Name: Go Call Graph Reachability Analysis
Author: openshift-eng

byopenshift-eng

•

セキュリティとテスト

Performs deep call graph analysis to determine if vulnerable functions are reachable from program entry points.

This skill provides high-confidence vulnerability assessments by tracing execution paths within Go applications. By leveraging specialized tools like callgraph and digraph, it generates definitive proof of whether a CVE-impacted function is actually reachable from main() or other entry points. This allows developers to prioritize security fixes based on real-world exploitability rather than just dependency presence, making it an essential tool for security compliance and auditing.

主な機能

01Supports multiple analysis algorithms (VTA, RTA, CHA) with automatic fallback

02Integration with security compliance and audit workflows

0360 GitHub stars

04Detailed call chain identification from main(), HTTP handlers, or test suites

05Definitive reachability proof from program entry points to vulnerable functions

06Visual execution path generation using Graphviz and SVG exports

ユースケース

01Prioritizing remediation efforts by filtering out unreachable vulnerabilities in dead code

02Generating visual evidence for security audits and compliance reports

03Validating if a detected CVE is actually exploitable in a specific codebase

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add openshift-eng/ai-helpers call-graph-analysis

For use in Claude.ai and ChatGPT

Download Skill