# Fallow Like

> Fallow-Like Static Analyzers

- Skill: `zedarvates/fallow-like` (Agent Skill, multi-file: 33 files)
- Install (CLI): `npx skillmds@latest add zedarvates/fallow-like`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zedarvates/fallow-like/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zedarvates (https://skillmd.com/u/zedarvates)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zedarvates/fallow-like

---

# Fallow-Like Static Analyzers
9 code analyzers: dead code, duplication, complexity, secrets, **taint (data-flow security)**, boundaries, feature flags, hot paths, blast radius.

**Trigger:** Code audit, quality/security checks, pre-commit analysis.

**Analyzers:**
- DeadCodeAnalyzer, DuplicationAnalyzer, ComplexityAnalyzer
- SecretsAnalyzer, **TaintAnalyzer**, BoundaryAnalyzer, FeatureFlagAnalyzer
- HotPathAnalyzer, BlastRadiusAnalyzer

**Module:** `skills/fallow_like`
**Health:** `calculate_health()` → score 0-100 + grade A-F
**Output:** JSON (compact), SARIF, or markdown (verbose)

## Taint / data-flow security (neuro-symbolic, local-first)

Inspired by RepoAudit/DeepAudit, in botte's local-first shape:

- **symbolic (0 tokens)** — Python `ast` traces attacker-controlled *sources*
  (`sys.argv`, `os.environ`/`getenv`, `input`, framework `request.*`) into
  dangerous *sinks* (`subprocess`/`os.system`/`eval`/`exec`, SQL `execute`,
  `pickle`/`yaml.load`/`marshal`, `urlopen`/`requests`) and flags
  insecure-by-default calls (`shell=True` + dynamic, `yaml.load` without a safe
  Loader). Each finding is **CWE-tagged** (78/89/94/502/918). No compilation.
- **neuro (0 cloud tokens, optional)** — `--judge` asks a LOCAL model to confirm
  each candidate (exploitable vs sanitized); it only annotates/adjusts confidence.

```bash
python -m skills.fallow_like.cli taint .            # data-flow security scan
python -m skills.fallow_like.cli taint . --judge    # + local-model confirmation
```

Exposed via [[llm_mcp]] as `security_scan`. v1 does intra-procedural data flow
for Python (botte's primary language); other languages are the next iteration.