This skill should be used when the user asks to "trace data flow", "follow user input", "source to sink analysis", "track variable", "find input sources", "taint analysis", or needs to understand how user-controlled data flows through an application during whitebox pentesting.
From vuln-scoutnpx claudepluginhub allsmog/vuln-scout --plugin vuln-scoutThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Guide the process of tracing user-controlled input from entry points (sources) through the application to security-sensitive functions (sinks). This is essential for confirming vulnerability exploitability.
Activate this skill when:
HTTP Sources:
| Language | Common Sources |
|---|---|
| PHP | $_GET, $_POST, $_REQUEST, $_COOKIE, $_FILES, $_SERVER |
| Java | request.getParameter(), request.getHeader(), @RequestParam |
| Python | request.args, request.form, request.data, request.json |
| Node.js | req.query, req.body, req.params, req.headers |
| .NET | Request.QueryString, Request.Form, Request["param"] |
Other Sources:
Refer to the dangerous-functions skill for comprehensive sink lists.
Track how data changes between source and sink:
Start from the dangerous function identified during code review.
Identify what variables/parameters are passed to the sink.
Example: system($cmd);
Direct parameter: $cmd
Follow each parameter to its origin:
Determine where user input enters:
$cmd = $_GET['command']; // Direct source
$cmd = $row['command']; // Database (check how it was stored)
$cmd = $config['cmd']; // Config file (check if user-modifiable)
Document all changes to the data:
Source: $_GET['input']
-> urldecode()
-> str_replace(['../', '..\\'], '', $input)
-> escapeshellarg()
-> Sink: exec()
Consider:
Forward Tracing: Start from source, follow to sinks
$input = $_GET['x'];
$processed = process($input);
dangerous_function($processed);
Backward Tracing: Start from sink, trace to source
dangerous_function($var);
<- $var = transform($data);
<- $data = $_POST['param'];
# Find where variable is assigned
grep -rn "\$varname\s*=" --include="*.php"
# Find where variable is used
grep -rn "\$varname" --include="*.php"
# Find function calls
grep -rn "functionName\s*(" --include="*.php"
$input = $_GET['cmd'];
system($input); // Vulnerable
// Store
$db->insert(['cmd' => $_POST['cmd']]);
// Later, retrieve and execute
$row = $db->query("SELECT cmd FROM jobs")->fetch();
system($row['cmd']); // Vulnerable if original input wasn't sanitized
// Config loaded from user-modifiable file
$config = parse_ini_file('/var/www/config.ini');
system($config['backup_cmd']); // Vulnerable if config is modifiable
// file1.php
$_SESSION['cmd'] = $_GET['cmd'];
// file2.php
system($_SESSION['cmd']); // Vulnerable
$input = htmlspecialchars($_GET['x']); // XSS protection
$input = escapeshellarg($_GET['x']); // Command injection protection
$input = intval($_GET['x']); // Type casting
$input = preg_replace('/[^a-z]/', '', $_GET['x']); // Whitelist
| Sanitization | Bypass Considerations |
|---|---|
| Blacklist | Missing characters, encoding |
| Whitelist | Logic errors, regex flaws |
| Type casting | Depends on sink requirements |
| Encoding | Double encoding, context |
| Length limits | Truncation attacks |
When tracing, document findings:
## Finding: [Vulnerability Type]
### Sink
- File: path/to/file.php
- Line: 42
- Function: system($cmd)
### Source
- File: path/to/file.php
- Line: 35
- Source: $_GET['command']
### Data Flow
1. $_GET['command'] received (line 35)
2. Passed to sanitize() function (line 36)
3. Concatenated with prefix (line 38)
4. Passed to system() (line 42)
### Sanitization
- sanitize() removes semicolons and pipes
- Bypass: Use newline (%0a) or $() syntax
### Exploitability
- Confirmed exploitable
- Payload: `valid_command%0awhoami`