vulnerability-root-cause-analyzer

Vulnerability Root Cause Analyzer

Analyze vulnerable code to identify the underlying root causes that enable security vulnerabilities.

Overview

Security vulnerabilities are symptoms of deeper issues in code design and implementation. This skill analyzes vulnerable code to identify:

1. Violated assumptions - What the code assumes but doesn't verify
2. Incorrect invariants - Properties that should hold but don't
3. Missing checks - Validation that should exist but is absent
4. Unsafe interactions - How components interact unsafely
5. Design flaws - Architectural issues that enable vulnerabilities

The goal is to understand WHY the vulnerability exists, not just WHAT it is.

Root Cause Analysis Workflow

Vulnerable Code
    ↓
Identify Vulnerability Type
    ↓
Trace Attack Vector
    ↓
Analyze Assumptions
    ↓
Check Invariants
    ↓
Identify Missing Checks
    ↓
Examine Component Interactions
    ↓
Determine Root Cause
    ↓
Explain Exploitation Chain

Analysis Process

Step 1: Identify Vulnerability Type

Classify the vulnerability:

Common types:

• Buffer overflow
• SQL injection
• Cross-site scripting (XSS)
• Authentication bypass
• Privilege escalation
• Use-after-free
• Race condition
• Integer overflow

Step 2: Trace Attack Vector

Understand how an attacker exploits the vulnerability:

Questions:

• What input triggers the vulnerability?
• What operations are performed?
• What security boundary is crossed?
• What is the impact?

Step 3: Analyze Assumptions

Identify implicit assumptions in the code:

Common assumptions:

• Input is trusted
• Buffer is large enough
• Integer won't overflow
• Pointer is valid
• User is authenticated
• Data is sanitized

Check: Are these assumptions verified?

Step 4: Check Invariants

Verify properties that should always hold:

Common invariants:

• Buffer bounds respected
• Pointers valid before dereference
• Authentication required for sensitive operations
• Data sanitized before use
• Resources properly released