New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Assemble Lib Rules

by seqra in seqra/opentaint

Connect the shared untrusted-data source group to new reusable OpenTaint sink groups.

Apache-2.0Auto-check passedSecurity

Install Assemble Lib Rules

skills CLI
$ npx skills add seqra/opentaint --skill assemble-lib-rules -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install seqra/opentaint assemble-lib-rules --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/assemble-lib-rules .claude/skills/assemble-lib-rules && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
assemble-lib-rules
GitHub stars
162
Token cost
~814 tokens
SKILL.md length
349 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
Apache-2.0

At a glance

Connect the shared untrusted-data source group to new reusable OpenTaint sink groups.

  • Works in 3 steps: Get the missing sink tags → Write one security join per missing sink… → Verify the matrix, then stop
  • Wire new sink tags into security joins
  • SKILL.md covers Inputs, Workflow, Output and Gotchas
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Assemble Lib Rules is an agent skill from seqra/opentaint. Connect the shared untrusted-data source group to new reusable OpenTaint sink groups. Use to wire new sink tags into security joins

Its SKILL.md is about 810 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis… The licence is Apache-2.0.

When your agent uses it

  • Wire new sink tags into security joins
  • Tasks that involve Static analysis and SAST

Example prompts

  • “/assemble-lib-rules”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Get the missing sink tags
  2. Write one security join per missing sink tag
  3. Verify the matrix, then stop

What it can do on your machine

Read from SKILL.md and the folder at commit f945f92. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Assemble Lib Rules loads about 814 tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 349 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~38
When it runs · the whole SKILL.md, loaded when a task matches
~814

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seqra/opentaint at commit f945f92, republished under its Apache-2.0 licence (© seqra). 349 words, ~814 tokens.

Download SKILL.mdSave it as .claude/skills/assemble-lib-rules/SKILL.md (or your agent's skills folder).
name
assemble-lib-rules
description
Connect the shared untrusted-data source group to new reusable OpenTaint sink groups. Use to wire new sink tags into security joins
license
Apache-2.0
metadata.author
opentaint
metadata.version
0.3.0

Skill: Assemble Lib Rules

Reusable source rules share the single untrusted-data-source tag. Write only the security joins that connect it to sink tags reported as uncovered by get_status.py. An existing join automatically includes every new library rule carrying either tag. The main scan verifies the joins.

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

  • project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
  • language (required) — target language for this project and language-specific instructions

Workflow

1. Get the missing sink tags

The orchestrator dispatches this skill only when get_status.py reports uncovered joins. Use that output as the complete worklist: each untrusted-data-source -> sink-tag line under reusable tag groups are not fully joined names one sink tag to connect. The script has already accounted for active built-in and custom library rules and for existing joins. Do not read those rules or recompute the matrix yourself.

2. Write one security join per missing sink tag

For each missing sink tag, write one join rule under .opentaint/rules/<lang>/security/<vulnerability>.yaml. Use the sink tag without its final -sink as the concise, globally unique <vulnerability> id — for example, regex-dos-sink becomes regex-dos. Reference the shared source tag and reported sink tag directly:

yaml
rules:
  - id: regex-dos
    severity: ERROR
    message: Untrusted data reaches a regular-expression denial-of-service sink
    metadata:
      cwe:
        - CWE-1333
      short-description: Regular expression denial of service via untrusted input
    languages:
      - <language>
    mode: join
    join:
      refs:
        - tag: untrusted-data-source
          as: source
        - tag: regex-dos-sink
          as: sink
      on:
        - 'source.$UNTRUSTED -> sink.$UNTRUSTED'

Both endpoints use $UNTRUSTED. Sink tags and join ids name vulnerability classes, not packages, frameworks, or individual methods: a newly created rule for an existing vulnerability class reuses that class's sink tag and therefore needs no new join. Derive accurate security metadata from the sink tag.

3. Verify the matrix, then stop

Run get_status.py again. If it still reports an assigned sink tag, fix that join and repeat. Finish when every reusable sink tag is connected to untrusted-data-source.

Output

Artifacts
  • one security join file per missing sink tag at .opentaint/rules/<lang>/security/<vulnerability>.yaml
Summary
  • one line per join: sink tag and rule id

Gotchas

  • Reference the reported sink tag directly, never re-declare or enumerate either tag group's lib-rule members
  • Keep produced joins comment-free

© seqra, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/assemble-lib-rules of seqra/opentaint.

Open the folder on GitHubat commit f945f92

Compare with similar skills

Assemble Lib Rules next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Assemble Lib Rules compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Assemble Lib Rules this skillseqra/opentaint162—~814Automated safety check: PassApache-2.0
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner286—~6.2kAutomated safety check: PassNone
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated today
    SecurityAuto-check: notes

  • LLM Sast Scanner

    SunWeb3Sec/llm-sast-scanner

    General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

    286 GitHub stars~6.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Triage Codeql

    netdata/netdata

    Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

    81k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

More from seqra/opentaint

All 16 skills in this repo

  • Analyze External Methods

    seqra/opentaint

    Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks.

    162 GitHub stars~3.2k tokensUpdated today
    Auto-check passed

  • Create Dataflow Approximation

    seqra/opentaint

    Model a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes.

    162 GitHub stars~1.9k tokensUpdated today
    Auto-check passed

  • Orchestrate Stage

    seqra/opentaint

    Run one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins.

    162 GitHub stars~806 tokensUpdated today
    Auto-check passed

  • Appsec Agent

    seqra/opentaint

    Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage.

    162 GitHub stars~2.2k tokensUpdated today
    Auto-check passed

  • Build Project

    seqra/opentaint

    Build a target project into an opentaint project model. An agent skill from seqra/opentaint.

    162 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Create Pass Through Approximation

    seqra/opentaint

    Model a method's taint propagation as a passThrough approximation.

    162 GitHub stars~1.7k tokensUpdated today
    Auto-check passed

Categories

Questions about Assemble Lib Rules

What does Assemble Lib Rules do?

Connect the shared untrusted-data source group to new reusable OpenTaint sink groups. Assemble Lib Rules is an agent skill from seqra/opentaint. Connect the shared untrusted-data source group to new reusable OpenTaint sink groups.

When should I use Assemble Lib Rules?

Assemble Lib Rules fits situations like: wire new sink tags into security joins; tasks that involve Static analysis and SAST.

How do I install Assemble Lib Rules in Claude Code?

Run `npx skills add seqra/opentaint --skill assemble-lib-rules -a claude-code`. Or copy the skill folder (skills/assemble-lib-rules in seqra/opentaint) into .claude/skills/assemble-lib-rules in your project. Claude Code loads it when a task matches its description.

How do I install Assemble Lib Rules in Codex?

Run `npx skills add seqra/opentaint --skill assemble-lib-rules -a codex`. Or copy the skill folder (skills/assemble-lib-rules in seqra/opentaint) into .agents/skills/assemble-lib-rules in your project. Codex loads it when a task matches its description.

Can I use Assemble Lib Rules in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seqra/opentaint --skill assemble-lib-rules -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/assemble-lib-rules, .gemini/skills/assemble-lib-rules, .github/skills/assemble-lib-rules and .opencode/skills/assemble-lib-rules in your project.

What does Assemble Lib Rules need to run?

SKILL.md names no scripts, command-line tools or credentials: Assemble Lib Rules is instructions for the agent only.

Does Assemble Lib Rules access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Assemble Lib Rules safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Assemble Lib Rules use?

Assemble Lib Rules is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Assemble Lib Rules use?

About 814 tokens (SKILL.md is roughly 3.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Assemble Lib Rules?

Skills that share tags, products or a category with Assemble Lib Rules: Semgrep (vigolium/piolium, 140 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Assemble Lib Rules?

seqra (a GitHub organization) maintains it in seqra/opentaint, which has 162 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: seqra/opentaint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.