# Source Assisted Analysis

Use attached source code as a SECONDARY accelerator for black-box testing - work the...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill source-assisted-analysis -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill source-assisted-analysis -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill source-assisted-analysis -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill source-assisted-analysis -g -a gemini-cli -y`

## Description

Use attached source code as a SECONDARY accelerator for black-box testing - work the auto-seeded source-to-route ledger first, trace call paths before claiming a sink is reachable, find hidden routes and extra hypotheses, and correlate confirmed runtime behavior back to code. Black-box remains primary.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Source-Assisted Analysis (Secondary Accelerator)

## Purpose

When source is attached, use it to generate leads, prioritize, and explain - NOT as a replacement for runtime proof. Xalgorix stays a black-box-first product: the application model and hypotheses come from runtime behavior; source accelerates and strengthens them.

```text
BLACK BOX (primary)                    SOURCE WHEN AVAILABLE (secondary)
application model                      additional leads
-> hypotheses                           -> source-to-runtime correlation
-> runtime testing                      -> higher confidence / faster testing
```

NOT: source scan -> everything else. The only exception is an explicit source-review-only scan mode, which continues to work as before.

## Entry Conditions

- Source code is attached to the scan (the source sweep at scan start seeds the ledger with correlated source-route hypotheses)
- OR: runtime behavior is surprising and the attached source can explain it

## What Source Is For

1. **Hidden routes and surface**: routes the crawler never found (internal/debug/deprecated controllers) - add them to the model as runtime-verified inventory
2. **Additional hypotheses**: dangerous handlers, parameters, and flows the black-box crawl did not prioritize
3. **Prioritization**: which observed endpoints sit near dangerous sinks - rank the black-box queue by this
4. **Explaining surprises**: when a runtime response is odd (unexpected parser behavior, weird error), trace it to code to understand what actually happened
5. **Strengthening evidence**: correlate a confirmed runtime finding to the code path that produces it - the report becomes harder to dispute
6. **Sink discovery beyond the crawl**: sinks reachable only through parameters/flows the UI does not expose

## The Seeded Ledger (Work It First)

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/application-security/source-assisted-analysis/SKILL.md