How deep does the taint analysis go?

It performs a foundational 1-2 layer trace of parameters to determine if they are hardcoded constants or originate from external variables and inputs.

Does this skill provide automated vulnerability fixes?

No, the skill is designed to identify and analyze risks without suggesting or implementing code changes, ensuring that developers perform their own security validation.

Which programming languages does this skill support?

Currently, the skill focuses primarily on Java projects (Maven and Gradle), with framework-specific checks for common enterprise libraries.

Can I use this for production-grade security reporting?

It is an excellent tool for rapid discovery and surface-level risk assessment, though complex logic vulnerabilities may still require professional manual review or deep DAST tools.

Vulnerability Sink Finder

Name: Vulnerability Sink Finder
Author: H4cking2theGate

byH4cking2theGate

•

보안 및 테스팅

Identifies dangerous sink functions and potential security vulnerabilities in web projects through automated code analysis and basic taint tracking.

The Vulnerability Sink Finder is a specialized security auditing tool for Claude Code designed to systematically locate dangerous function calls (Sinks) within a codebase. It automatically identifies entry points for high-risk vulnerabilities such as Command Injection, Deserialization, SQL Injection, and JNDI Injection. By performing 1-2 layers of parameter source analysis, it helps developers and security researchers assess user-controllability and potential risk levels, generating a structured security audit report directly within the project environment.

주요 기능

01Automatic project language and framework detection for Java (Maven/Gradle)

02Basic 1-2 layer taint analysis to evaluate parameter controllability from user input

03Standardized markdown report generation saved directly to the project root

04Automated detection of high-risk sinks including RCE, Deserialization, and SQL Injection

05Dependency auditing for vulnerable libraries like Fastjson, SnakeYAML, and Jackson

064 GitHub stars

사용 사례

01Systematically searching for specific vulnerability patterns during penetration testing

02Conducting initial security audits on new or inherited codebases to map attack surfaces

03Assessing the security risk of third-party dependencies and their implementation

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add h4cking2thegate/auditskills finding-sinks

For use in Claude.ai and ChatGPT

Download Skill