# Gitnexus Taint Analysis

Use when working on, reviewing, or extending GitNexus's CFG/taint/PDG subsystem (the...

- Repository: https://github.com/abhigyanpatwari/GitNexus (48173 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -g -a claude-code -y`
Codex: `npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -g -a codex -y`
Cursor: `npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -g -a cursor -y`
Gemini CLI: `npx skills add abhigyanpatwari/GitNexus --skill gitnexus-taint-analysis -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add abhigyanpatwari/GitNexus`

## Description

Use when working on, reviewing, or extending GitNexus's CFG/taint/PDG subsystem (the `--pdg` layers), or when reasoning about source→sink data-flow findings. Examples: \"How does taint analysis work here?\", \"Why didn't explain find this flow?\", \"Add a new sink/source\", \"Review the interprocedural taint code\".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CFG & Taint Analysis with GitNexus

Expert knowledge for the opt-in `--pdg` program-analysis subsystem: control-flow
graphs, reaching definitions, and intra- + inter-procedural taint. Read this
before touching `gitnexus/src/core/ingestion/cfg/**` or
`gitnexus/src/core/ingestion/taint/**`, or when explaining a finding.

## When to Use

- "How does the taint engine work / why is this flow (not) reported?"
- Adding a source, sink, or sanitizer to the model.
- Extending or reviewing the CFG / reaching-defs / taint / summary code.
- Understanding the `explain` MCP tool's findings (intra- vs inter-procedural).
- Debugging a false positive or false negative in `--pdg` output.

## The layered substrate (build order)

Taint runs **on** the graph, not beside it. Each layer is opt-in behind `--pdg`
and a default `analyze` run is **byte-identical** (the golden parity gate is the
hard floor for every change here).

```
L1  CFG            per-function basic blocks + control-flow edges   (M1 #2081)
L2  REACHING_DEF   GEN/KILL def→use data dependence (pure solver)   (M2 #2082)
L3  Taint (intra)  source→sink over RD facts, minus sanitizers      (M3 #2083)
L4  Taint (inter)  per-function summaries composed over CALLS       (M4 #2084)
```

The rest: https://github.com/abhigyanpatwari/GitNexus/blob/HEAD/gitnexus-claude-plugin/skills/gitnexus-taint-analysis/SKILL.md