seqra
- 16 skills
- 0 followers
- 6 hours ago last updated
- ▌ Run Scan · seqraRun an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project
- ▌ Debug Rule · seqraDebug a rule or approximation that behaves unexpectedly by tracing where taint is dropped. Use when its samples won't pass after repeated attempts, or it passes tests but is wrong on a real scan
- ▌ Create Rule · seqra bundleAuthor and verify an OpenTaint rule. Use whenever a rule creation is needed
- ▌ Appsec Agent · seqra bundleRun an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage. Use when the user asks to find vulnerabilities, or scan an application for security issues
- ▌ Generate Poc · seqra bundleReproduce a true-positive finding against the running application. Use when a finding needs dynamic confirmation
- ▌ Build Project · seqra bundleBuild a target project into an opentaint project model. Use whenever a fresh opentaint project model needed
- ▌ Analyze Findings · seqraTriage OpenTaint findings statically. Use when scan findings need a TP/FP verdict
- ▌ Orchestrate Stage · seqra bundleRun one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins. Use when a separate OpenTaint pipeline stage needs to be executed
- ▌ Assemble Lib Rules · seqraWrite the per-vuln-class security join rules that merge the created source/sink lib rules with the built-ins. Use to wire lib rules into project-level joins
- ▌ Create Test Project · seqra bundleCreate an OpenTaint test project with positive/negative samples for verifying a rule or approximation. Use when a rule or approximation needs a test project to check against
- ▌ Triage Dependencies · seqraMark which of a project's dependency libraries could introduce taint sources. Use to start source discovery
- ▌ Report Analyzer Issue · seqraWrite a self-contained OpenTaint engine-issue report from an analysis diagnosis or a full-scan failure. Use when an engine-side issue needs a report
- ▌ Discover Attack Surface · seqra bundleClassify project-used dependency members and record the taint sources among them not covered by the built-in rules. Use for the source-discovery depth pass
- ▌ Analyze External Methods · seqra bundleAnalyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks. Use when a dropped-external-methods.yaml needs classification for dropped method type
- ▌ Create Dataflow Approximation · seqra bundleModel a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes. Use for a dropped method that requires code-based approximation
- ▌ Create Pass Through Approximation · seqra bundleModel a method's taint propagation as a passThrough approximation. Use for a dropped method whose propagation is simple copying