“static-analysis”的搜索结果

ELF binary statik analiz — file, strings, objdump, readelf, nm, Ghidra workflow

中文简介正在准备中。当前显示原文说明。

Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.

中文简介正在准备中。当前显示英语简介。

• Reviewing a repository for security vulnerabilities
• Checking authorization logic in a specific service
• Reviewing security risks introduced by a branch

Plan and coordinate Strix security assessments across source code, running applications, APIs, and continuous integration pipelines. Combine findings into one prioritized remediation plan based on demonstrated impact, removing duplicates and documenting gaps in test coverage.

中文简介正在准备中。当前显示英语简介。

• Choosing suitable security tests for a product
• Planning a security assessment before launch
• Combining findings into a prioritized remediation plan

Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.

中文简介正在准备中。当前显示英语简介。

• Vetting a new npm dependency before adoption
• Reviewing dependency files during code review
• Checking lockfiles against known-malicious versions

Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.

中文简介正在准备中。当前显示英语简介。

• Identifying suspected UPX-packed samples
• Investigating failed UPX decompression
• Recovering binaries with a debugger

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

中文简介正在准备中。当前显示英语简介。

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

中文简介正在准备中。当前显示英语简介。

• Triage suspicious APK files without running them
• Inspect dangerous permission combinations and suspicious API calls
• Extract network indicators for malware detection rules

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Assess a single suspected security issue using Trailmark's graph of code relationships. Gather evidence about reachable paths, input flow, and potential impact, then receive a priority verdict and a list of remaining manual checks.

中文简介正在准备中。当前显示英语简介。

• Prioritizing a static analysis finding before proof-of-concept work
• Checking whether entry points can reach a suspicious function
• Preparing code evidence for exploit validation

Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.

中文简介正在准备中。当前显示英语简介。

• Finding variants of a known vulnerability
• Prioritizing code that shares sensitive operations
• Preparing candidates for Semgrep or CodeQL review

Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.

中文简介正在准备中。当前显示英语简介。

• Audit source code for security weaknesses
• Check for vulnerabilities before code review
• Focus on findings with medium-to-high confidence and impact

Turn security findings into candidate code fixes with review results and summaries. Depending on the input, use independent source review or a pipeline with execution checks, then provide diffs for a person to review and apply.

中文简介正在准备中。当前显示英语简介。

• Generating candidate fixes from triaged findings
• Preparing diffs for the highest-priority vulnerabilities
• Independently reviewing proposed security fixes

Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis. Use when Semgrep or a static-analysis scan is requested; use security-review for a manual audit.

中文简介正在准备中。当前显示原文说明。

Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification

中文简介正在准备中。当前显示原文说明。

Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl"

中文简介正在准备中。当前显示原文说明。

Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.

中文简介正在准备中。当前显示原文说明。

Detects time and space complexity hotspots via AST scan. Use when code feels slow, before performance-sensitive merges, or to find O(n²) regressions.

中文简介正在准备中。当前显示原文说明。

Detects codebase bloat via dead code, duplication, complexity, and doc bloat scans. Use when codebase feels large or before a release.

中文简介正在准备中。当前显示原文说明。

ESLint is the standard linting tool for JavaScript and TypeScript projects. It statically analyzes your code to find problems, enforce coding conventions, and catch bugs before they reach production. ESLint 9 introduced the flat config format, replacing the legacy `.eslintrc` system with a simpler, more composable `eslint.config.js` file. With a rich plugin ecosystem covering React, TypeScript, accessibility, and import ordering, ESLint is the backbone of code quality in modern web development.

中文简介正在准备中。当前显示原文说明。

Measures cyclomatic complexity, cognitive complexity, and function length across codebases to identify maintenance hotspots. Use when someone asks about code complexity, function length analysis, maintainability metrics, or needs to find the most complex parts of their codebase. Trigger words: complexity, cyclomatic, cognitive complexity, long functions, hotspots, maintainability index, code metrics.

中文简介正在准备中。当前显示原文说明。

Statically enforce a privacy/redaction boundary on an artifact tree before publication, the way an AST checker enforces a code contract. Builds a two-tier gate — a shape-based deny-list (regex over identifier shapes) plus a structure-aware tier that parses JSON/HTML/SVG/Markdown/code and asserts sensitive content cannot appear in meaningful positions — with a strict exit-code contract, label-only output that never echoes the patterns themselves, and false-positive narrowing instead of suppressions. Use when gating a public mirror, a disclosure draft, a wire-capture export, or any artifact that must pass a leak check before it ships, and when a plain line-grep is too coarse to trust.

中文简介正在准备中。当前显示原文说明。

Run CodeQL and Semgrep static analysis with SARIF output for vulnerability detection, code quality assessment, and security compliance scanning across multiple languages.

中文简介正在准备中。当前显示原文说明。

Write custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.

中文简介正在准备中。当前显示原文说明。

Perform static reverse engineering and analysis on Windows Portable Executable (PE) files to identify malicious indicators without executing the file. Use this skill during Incident Response, malware triage, or threat hunting to safely extract metadata, imported APIs, exported functions, embedded strings, and packed indicators from suspicious Windows binaries (.exe, .dll, .sys).

中文简介正在准备中。当前显示原文说明。