Fallow-Like Static Analyzers
9 code analyzers: dead code, duplication, complexity, secrets, taint (data-flow security), boundaries, feature flags, hot paths, blast radius.
Trigger: Code audit, quality/security checks, pre-commit analysis.
Analyzers:
- DeadCodeAnalyzer, DuplicationAnalyzer, ComplexityAnalyzer
- SecretsAnalyzer, TaintAnalyzer, BoundaryAnalyzer, FeatureFlagAnalyzer
- HotPathAnalyzer, BlastRadiusAnalyzer
Module: skills/fallow_like
Health: calculate_health() → score 0-100 + grade A-F
Output: JSON (compact), SARIF, or markdown (verbose)
Taint / data-flow security (neuro-symbolic, local-first)
Inspired by RepoAudit/DeepAudit, in botte's local-first shape:
- symbolic (0 tokens) — Python
ast traces attacker-controlled sources
(sys.argv, os.environ/getenv, input, framework request.*) into
dangerous sinks (subprocess/os.system/eval/exec, SQL execute,
pickle/yaml.load/marshal, urlopen/requests) and flags
insecure-by-default calls (shell=True + dynamic, yaml.load without a safe
Loader). Each finding is CWE-tagged (78/89/94/502/918). No compilation.
- neuro (0 cloud tokens, optional) —
--judge asks a LOCAL model to confirm
each candidate (exploitable vs sanitized); it only annotates/adjusts confidence.
python -m skills.fallow_like.cli taint . # data-flow security scan
python -m skills.fallow_like.cli taint . --judge # + local-model confirmation
Exposed via [[llm_mcp]] as security_scan. v1 does intra-procedural data flow
for Python (botte's primary language); other languages are the next iteration.
1---2name: fallow-like3description: Fallow-Like Static Analyzers4---5# Fallow-Like Static Analyzers69 code analyzers: dead code, duplication, complexity, secrets, **taint (data-flow security)**, boundaries, feature flags, hot paths, blast radius.78**Trigger:** Code audit, quality/security checks, pre-commit analysis.910**Analyzers:**11- DeadCodeAnalyzer, DuplicationAnalyzer, ComplexityAnalyzer12- SecretsAnalyzer, **TaintAnalyzer**, BoundaryAnalyzer, FeatureFlagAnalyzer13- HotPathAnalyzer, BlastRadiusAnalyzer1415**Module:** `skills/fallow_like`16**Health:** `calculate_health()` → score 0-100 + grade A-F17**Output:** JSON (compact), SARIF, or markdown (verbose)1819## Taint / data-flow security (neuro-symbolic, local-first)2021Inspired by RepoAudit/DeepAudit, in botte's local-first shape:2223- **symbolic (0 tokens)** — Python `ast` traces attacker-controlled *sources*24 (`sys.argv`, `os.environ`/`getenv`, `input`, framework `request.*`) into25 dangerous *sinks* (`subprocess`/`os.system`/`eval`/`exec`, SQL `execute`,26 `pickle`/`yaml.load`/`marshal`, `urlopen`/`requests`) and flags27 insecure-by-default calls (`shell=True` + dynamic, `yaml.load` without a safe28 Loader). Each finding is **CWE-tagged** (78/89/94/502/918). No compilation.29- **neuro (0 cloud tokens, optional)** — `--judge` asks a LOCAL model to confirm30 each candidate (exploitable vs sanitized); it only annotates/adjusts confidence.3132```bash33python -m skills.fallow_like.cli taint . # data-flow security scan34python -m skills.fallow_like.cli taint . --judge # + local-model confirmation35```3637Exposed via [[llm_mcp]] as `security_scan`. v1 does intra-procedural data flow38for Python (botte's primary language); other languages are the next iteration.
zedarvates