Statically analyze code to detect security vulnerabilities including buffer overflows, injection risks (SQL, command, XSS), insecure deserialization, improper authentication, hard-coded credentials, and unsafe cryptography. Use when: (1) Performing security code review, (2) Analyzing code for OWASP Top 10 vulnerabilities, (3) Identifying CWE-classified weaknesses, (4) Generating security audit reports, (5) Reviewing code before deployment, or (6) Assessing third-party code security. Findings categorized by CWE ID and severity (Critical/High/Medium/Low).
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Analyze code for security vulnerabilities with CWE classification and severity assessment.
Systematically examine code for vulnerability patterns:
Memory Safety (C/C++):
Injection Vulnerabilities:
Authentication & Authorization:
Cryptographic Issues:
Deserialization:
Input Validation:
For each vulnerability category, identify:
Dangerous Functions:
strcpy, sprintf, gets, scanfpickle.loads, eval, execos.system, subprocess with shell=TrueUnsafe Patterns:
Context Analysis:
Assign severity based on:
CRITICAL:
HIGH:
MEDIUM:
LOW:
Assess confidence in finding:
HIGH: Clear vulnerability pattern, no mitigating factors MEDIUM: Vulnerability likely but context unclear LOW: Potential issue requiring manual verification
Structure findings as:
## Vulnerability: [Title]
**ID**: VULN-[number]
**CWE**: CWE-[ID]
**Severity**: [CRITICAL/HIGH/MEDIUM/LOW]
**Confidence**: [HIGH/MEDIUM/LOW]
**Location**: [File:Line]
### Description
[What the vulnerability is]
### Code Snippet
```[language]
[vulnerable code]
[fixed code]
## Vulnerability Categories
### Memory Safety (C/C++)
**Buffer Overflow (CWE-119)**:
```c
// VULNERABLE
char buf[10];
strcpy(buf, user_input); // No bounds check
Use-After-Free (CWE-416):
// VULNERABLE
free(ptr);
ptr->field = value; // Use after free
SQL Injection (CWE-89):
# VULNERABLE
query = f"SELECT * FROM users WHERE id = {user_id}"
cursor.execute(query)
Command Injection (CWE-78):
# VULNERABLE
os.system("ping " + user_host)
XSS (CWE-79):
// VULNERABLE
element.innerHTML = user_input;
Missing Authentication (CWE-306):
# VULNERABLE
@app.route('/admin')
def admin_panel():
return render_template('admin.html') # No auth check
Hard-coded Credentials (CWE-798):
# VULNERABLE
PASSWORD = "admin123"
API_KEY = "sk-1234567890"
Weak Algorithm (CWE-327):
# VULNERABLE
hash = hashlib.md5(password.encode()).hexdigest()
Weak Random (CWE-330):
# VULNERABLE
token = random.randint(1000, 9999) # For security token
Untrusted Data (CWE-502):
# VULNERABLE
obj = pickle.loads(user_data) # RCE possible
Path Traversal (CWE-22):
# VULNERABLE
with open(f'/uploads/{filename}', 'r') as f: # ../../../etc/passwd
content = f.read()
SSRF (CWE-918):
# VULNERABLE
response = requests.get(user_url) # Can access internal services
Track tainted data from source to sink:
Sources (user input):
Sinks (dangerous operations):
Sanitization (check for):
Dangerous function calls:
Missing security controls:
Weak configurations:
For detailed vulnerability patterns and remediation, see cwe_patterns.md.
Key CWE categories:
# Security Vulnerability Report
**Scan Date**: [Date]
**Code Base**: [Project]
**Total Findings**: [Count]
## Severity Breakdown
- Critical: [Count]
- High: [Count]
- Medium: [Count]
- Low: [Count]
For each vulnerability:
Prioritized action items:
For complete vulnerability detection examples including:
See examples.md.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Applies abstract interpretation using different abstract domains (intervals, octagons, polyhedra, sign, congruence) to statically analyze program variables and infer invariants, value ranges, and relationships. Use when analyzing program properties, inferring loop invariants, detecting potential errors, or understanding variable relationships through static analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Uses abstract interpretation to automatically infer loop invariants, function preconditions, and postconditions for formal verification. Generates invariants that capture program behavior and support correctness proofs in Dafny, Isabelle, Coq, and other verification systems. Use when adding formal specifications to code, generating verification conditions, inferring contracts for functions, or discovering loop invariants for proofs.
日本語の概要は準備中です。原文の説明を表示しています。
Performs abstract interpretation over source code to infer possible program states, variable ranges, and data properties without executing the program. Reports potential runtime errors including out-of-bounds accesses, null dereferences, type inconsistencies, division by zero, and integer overflows. Use when analyzing code for potential runtime errors, performing static analysis, checking safety properties, or verifying program behavior without execution.
日本語の概要は準備中です。原文の説明を表示しています。
Performs abstract interpretation to produce summarized execution traces and high-level program behavior representations. Highlights key control flow paths, variable relationships, loop invariants, function summaries, and potential runtime states using abstract domains (intervals, signs, nullness, etc.). Use when analyzing program behavior, understanding execution paths, computing loop invariants, tracking variable ranges, detecting potential runtime errors, or generating program summaries without concrete execution.
日本語の概要は準備中です。原文の説明を表示しています。
Create ACSL (ANSI/ISO C Specification Language) formal annotations for C/C++ programs. Use this skill when working with formal verification, adding function contracts (requires/ensures), loop invariants, assertions, memory safety annotations, or any ACSL specifications. Supports Frama-C verification and generates comprehensive formal specifications for C/C++ code.
日本語の概要は準備中です。原文の説明を表示しています。
CLI-based browser automation with persistent page state using ref-based element interaction. Use when users ask to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
日本語の概要は準備中です。原文の説明を表示しています。