mcpField
A
assemble-lib-rules

assemble-lib-rules

github.com/seqraSecurity17058 installsUpdated 1d ago
Repository

About assemble-lib-rules

A security skill for OpenTaint that adds rules joining the shared untrusted-data-source tag to uncovered sink tags reported by get_status.py. It verifies the join matrix and stops when all reusable sink tags are connected.

Key features

  1. 01Use uncovered sink tags as the worklist
  2. 02Write one security join per missing tag
  3. 03Reference shared source and sink tags
  4. 04Verify joins with get_status.py

Use cases

  1. 01Connect an untrusted-data source to an uncovered sink class
  2. 02Complete reusable rule joins after a status report

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/seqra/opentaint --skill assemble-lib-rules

After installing, type/assemble-lib-rulesin Claude Code to confirm it loaded.

Details

From the project README

Skill: Assemble Lib Rules

Reusable source rules share the single untrusted-data-source tag. Write only the security joins that connect it to sink tags reported as uncovered by get_status.py. An existing join automatically includes every new library rule carrying either tag. The main scan verifies the joins.

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

  • project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
  • language (required) — target language for this project and language-specific instructions

Workflow

1. Get the missing sink tags

The orchestrator dispatches this skill only when get_status.py reports uncovered joins. Use that output as the complete worklist: each untrusted-data-source -> sink-tag line under reusable tag groups are not fully joined names one sink tag to connect. The script has already accounted for active built-in and custom library rules and for existing joins. Do not read those rules or recompute the matrix yourself.

2. Write one security join per missing sink tag

For each missing sink tag, write one join rule under .opentaint/rules/<lang>/security/<vulnerability>.yaml. Use the sink tag without its final -sink as the concise, globally unique <vulnerability> id — for example, regex-dos-sink becomes regex-dos. Reference the shared source tag and reported sink tag directly:

rules:
  - id: regex-dos
    severity: ERROR
    message: Untrusted data reaches a regular-expression denial-of-service sink
    metadata:
      cwe:
        - CWE-1333
      short-description: Regular expression denial of service via untrusted input
    languages:
      - <language>
    mode: join
    join:
      refs:
        - tag: untrusted-data-source
          as: source
        - tag: regex-dos-sink
          as: sink
      on:
        - 'source.$UNTRUSTED -> sink.$UNTRUSTED'

Both endpoints use $UNTRUSTED. Sink tags and join ids name vulnerability classes, not packages, frameworks, or individual methods: a newly created rule for an existing vulnerability class reuses that class's sink tag and therefore needs no new join. Derive accurate security metadata from the sink tag.

3. Verify the matrix, then stop

Run get_status.py again. If it still reports an assigned sink tag, fix that join and repeat. Finish when every reusable sink tag is connected to untrusted-data-source.

Output

Artifacts
  • one security join file per missing sink tag at .opentaint/rules/<lang>/security/<vulnerability>.yaml
Summary
  • one line per join: sink tag and rule id

Gotchas

  • Reference the reported sink tag directly, never re-declare or enumerate either tag group's lib-rule members
  • Keep produced joins comment-free

Comments

Markdown supported