Results for “static-analysis”

ELF binary statik analiz — file, strings, objdump, readelf, nm, Ghidra workflow

The English summary is being prepared. Showing the original description.

Plan and coordinate Strix security assessments across source code, running applications, APIs, and continuous integration pipelines. Combine findings into one prioritized remediation plan based on demonstrated impact, removing duplicates and documenting gaps in test coverage.

• Choosing suitable security tests for a product
• Planning a security assessment before launch
• Combining findings into a prioritized remediation plan

Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.

• Reviewing a repository for security vulnerabilities
• Checking authorization logic in a specific service
• Reviewing security risks introduced by a branch

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.

• Identifying suspected UPX-packed samples
• Investigating failed UPX decompression
• Recovering binaries with a debugger

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

• Triage suspicious APK files without running them
• Inspect dangerous permission combinations and suspicious API calls
• Extract network indicators for malware detection rules

Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.

• Finding variants of a known vulnerability
• Prioritizing code that shares sensitive operations
• Preparing candidates for Semgrep or CodeQL review

Assess a single suspected security issue using Trailmark's graph of code relationships. Gather evidence about reachable paths, input flow, and potential impact, then receive a priority verdict and a list of remaining manual checks.

• Prioritizing a static analysis finding before proof-of-concept work
• Checking whether entry points can reach a suspicious function
• Preparing code evidence for exploit validation

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Turn security findings into candidate code fixes with review results and summaries. Depending on the input, use independent source review or a pipeline with execution checks, then provide diffs for a person to review and apply.

• Generating candidate fixes from triaged findings
• Preparing diffs for the highest-priority vulnerabilities
• Independently reviewing proposed security fixes

Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis. Use when Semgrep or a static-analysis scan is requested; use security-review for a manual audit.

The English summary is being prepared. Showing the original description.

Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification

The English summary is being prepared. Showing the original description.

Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl"

The English summary is being prepared. Showing the original description.

Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.

The English summary is being prepared. Showing the original description.

Detects time and space complexity hotspots via AST scan. Use when code feels slow, before performance-sensitive merges, or to find O(n²) regressions.

The English summary is being prepared. Showing the original description.

Detects codebase bloat via dead code, duplication, complexity, and doc bloat scans. Use when codebase feels large or before a release.

The English summary is being prepared. Showing the original description.

ESLint is the standard linting tool for JavaScript and TypeScript projects. It statically analyzes your code to find problems, enforce coding conventions, and catch bugs before they reach production. ESLint 9 introduced the flat config format, replacing the legacy `.eslintrc` system with a simpler, more composable `eslint.config.js` file. With a rich plugin ecosystem covering React, TypeScript, accessibility, and import ordering, ESLint is the backbone of code quality in modern web development.

The English summary is being prepared. Showing the original description.

Measures cyclomatic complexity, cognitive complexity, and function length across codebases to identify maintenance hotspots. Use when someone asks about code complexity, function length analysis, maintainability metrics, or needs to find the most complex parts of their codebase. Trigger words: complexity, cyclomatic, cognitive complexity, long functions, hotspots, maintainability index, code metrics.

The English summary is being prepared. Showing the original description.

Statically enforce a privacy/redaction boundary on an artifact tree before publication, the way an AST checker enforces a code contract. Builds a two-tier gate — a shape-based deny-list (regex over identifier shapes) plus a structure-aware tier that parses JSON/HTML/SVG/Markdown/code and asserts sensitive content cannot appear in meaningful positions — with a strict exit-code contract, label-only output that never echoes the patterns themselves, and false-positive narrowing instead of suppressions. Use when gating a public mirror, a disclosure draft, a wire-capture export, or any artifact that must pass a leak check before it ships, and when a plain line-grep is too coarse to trust.

The English summary is being prepared. Showing the original description.

Run CodeQL and Semgrep static analysis with SARIF output for vulnerability detection, code quality assessment, and security compliance scanning across multiple languages.

The English summary is being prepared. Showing the original description.

Write custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.

The English summary is being prepared. Showing the original description.

Perform static reverse engineering and analysis on Windows Portable Executable (PE) files to identify malicious indicators without executing the file. Use this skill during Incident Response, malware triage, or threat hunting to safely extract metadata, imported APIs, exported functions, embedded strings, and packed indicators from suspicious Windows binaries (.exe, .dll, .sys).

The English summary is being prepared. Showing the original description.