# Analyzing Taint Flow > Tracks untrusted input propagation from sources to sinks in binary code to identify injection vulnerabilities. Use when analyzing data flow, tracing user input to dangerous functions, or detecting command/SQL injection. Use when this capability is needed. - Skill: `tomevault-io/analyzing-taint-flow` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/analyzing-taint-flow` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/analyzing-taint-flow/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Data & Analytics - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/analyzing-taint-flow --- # Taint Analysis ## Detection Workflow 1. **Identify sources**: Find recv, read, getenv, fgets, scanf, argv (input functions) 2. **Identify sinks**: Find system, popen, strcpy, sprintf, execve, malloc (dangerous functions) 3. **Find taint paths**: Use `xrefs_to` to trace from sources to sinks 4. **Analyze sanitization**: Check for input validation, length checks, character filtering, encoding/escaping 5. **Assess risk**: Determine reachability, check if attacker controls critical parts, evaluate exploitability ## Key Patterns - Direct command injection: recv() -> buffer -> sprintf(cmd, "echo %s", buffer) -> system(cmd) - Path traversal: fgets() -> filename -> fopen(filename, "r") - Buffer overflow via tainted size: recv() -> size_buffer -> atoi(size_buffer) -> malloc(size) ## Output Format Report taint paths with: source (function, address, context), sink (function, address, context), path (list of functions), sanitizers_found, is_vulnerable, confidence, vulnerability_type. ## Severity Guidelines - **CRITICAL**: Direct injection with no sanitization (command injection, SQL injection) - **HIGH**: Path traversal, buffer overflow via tainted size - **MEDIUM**: Potential injection with partial sanitization - **LOW**: Tainted data with limited impact ## See Also - `patterns.md` - Detailed detection patterns and exploitation scenarios - `examples.md` - Example analysis cases and code samples - `references.md` - CWE references and mitigation strategies --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/waiwai24) — claim your Tome and manage your conversions.