gitnexus-taint-analysis — Claude Code skill: GitNexus taint analysis

What gitnexus-taint-analysis does

This skill hands the agent working knowledge of GitNexus's opt-in --pdg subsystem: control-flow graphs, reaching definitions, and taint tracked both inside a function and across calls. Reach for it when a finding from the explain tool needs explaining, when a new source, sink or sanitizer goes into the model, or when a false positive in --pdg output has to be tracked down.

The design is layered. L1 builds a CFG per function, L2 solves reaching definitions, L3 walks source-to-sink paths within a function while honouring sanitizers, and L4 composes per-function summaries over the call graph. Parsing fills a side channel with plain data; the solvers themselves are pure and run on the main thread. Every layer sits behind --pdg, so a plain analyze run stays byte-identical.

Know the gaps before you rely on it. Taint does not travel into closures or callbacks — without per-library models that flow is lost. Field and property flows, guard-style sanitizers and promise-based async threading are also deferred. Context-insensitivity is a deliberate choice here: one summary per function, so merged call sites can produce false positives.