discover-attack-surface

Skill: Discover Attack Surface

Work one assignment of project-used dependency members and pick out the taint sources among them — the methods where untrusted data first enters. The concrete inspection commands and value formats are language-specific — read references/<language>.md per Inputs and follow its numbered steps, which key to the ones below

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

• project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
• language (required) — target language for this project and language-specific instructions
• plan (required) — path to this agent's partition plan .opentaint/tracking/rules/plans/<id>.yaml: the project-used members to classify

Workflow

1. Settle built-in coverage first

Before anything, for each package the plan touches see what the built-in source rules already match for its members — opentaint health --rules prints the built-in rules root path; browse it and the project's own rules (per the language reference). This decides whether you write a source unit:

• full — existing rules already match the project-used sources → write no unit, stop, don't drill further
• partial — some project-used sources matched, others missed → plan only the missing used members
• none — plan the package's project-used sources from scratch

2. Classify the plan's members

The members are the FQNs under the plan's scopes — the project-used scope, already extracted, and only the members not yet classified in a prior run. Confirm each package's dependency identity and inspect its signatures/docs while classifying (per the language reference); read app source, dependency API/docs, and framework config to classify the listed members.