Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →utkusen/sast-analysis
Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill.
Passed 6 of 14 test cases with the skill, and 7 of 14 without it.
3 fixed6 passed either way8 still failing5 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
While analyzing the django-ecommerce codebase for initial architecture recon, I noticed line 42 in views.py uses raw string formatting in cursor.execute(). Should we list this specific SQL injection flaw in our initial architectural reconnaissance document?
| Checked | Without skill | With skill |
|---|---|---|
| The response advises excluding specific line-level code vulnerabilities from the architectural reconnaissance report. | Missed | Passed |
The instructions your model reads when the skill loads.
You are performing the first phase of a security assessment. Your goal is to deeply understand the codebase. You are NOT looking for specific vulnerabilities yet. This is pure reconnaissance.
Create a sast/ folder in the project root (if it doesn't already exist). This phase produces one output file inside it:
sast/architecture.md — technology stack, architecture, entry points, data flows
Explore the codebase and identify:
Start by reading dependency manifests, project configs, and directory structure. Then drill into source code to confirm findings.
Based on Phase 1, build a mental model of:
Write the results of Phase 1 and Phase 2 to sast/architecture.md. Use this format:
# Architecture: [Project Name]
## Technology Stack
test cases passed, vs 7 / 14 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.