# gitnexus-taint-analysis

A skill that teaches the agent GitNexus's CFG/taint/PDG internals: reading findings, adding sources and sinks, editing interprocedural code.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 335 installs · ★ 48043
- Author: abhigyanpatwari
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/abhigyanpatwari/GitNexus/tree/HEAD/gitnexus-claude-plugin/skills/gitnexus-taint-analysis/SKILL.md
- Updated: 2026-10-25
- HTML: https://affpapa.org/en/nevibecode/skills/gitnexus-taint-analysis

## What it does

This skill hands the agent working knowledge of GitNexus's opt-in `--pdg` subsystem: control-flow graphs, reaching definitions, and taint tracked both inside a function and across calls. Reach for it when a finding from the `explain` tool needs explaining, when a new source, sink or sanitizer goes into the model, or when a false positive in `--pdg` output has to be tracked down.

The design is layered. L1 builds a CFG per function, L2 solves reaching definitions, L3 walks source-to-sink paths within a function while honouring sanitizers, and L4 composes per-function summaries over the call graph. Parsing fills a side channel with plain data; the solvers themselves are pure and run on the main thread. Every layer sits behind `--pdg`, so a plain `analyze` run stays byte-identical.

Know the gaps before you rely on it. Taint does not travel into closures or callbacks — without per-library models that flow is lost. Field and property flows, guard-style sanitizers and promise-based async threading are also deferred. Context-insensitivity is a deliberate choice here: one summary per function, so merged call sites can produce false positives.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/gitnexus-taint-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/gitnexus-taint-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/gitnexus-taint-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/gitnexus-taint-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install abhigyanpatwari/GitNexus gitnexus-taint-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/gitnexus-taint-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/abhigyanpatwari/GitNexus --path gitnexus-claude-plugin/skills/gitnexus-taint-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/gitnexus-taint-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/abhigyanpatwari/GitNexus/tree/HEAD/gitnexus-claude-plugin/skills/gitnexus-taint-analysis/SKILL.md

## When to use it
- explain why `explain` missed a particular data flow
- add a new source, sink or sanitizer to the model
- debug a false positive in `--pdg` output
- extend or review the CFG and reaching-definitions code
- tell intra-procedural findings apart from interprocedural ones

## Example prompts
- How does the taint engine work here, and why wasn't this flow reported?
- Add a new sink for `db.query` to the taint model.
- Review the interprocedural taint code under `gitnexus/src/core/ingestion/taint/**`.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [abhigyanpatwari/gitnexus](https://affpapa.org/en/nevibecode/by/abhigyanpatwari/gitnexus.md) — 8 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md