New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Debug Rule

by seqra in seqra/opentaint

Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped.

Apache-2.0Auto-check passedSecurity

Install Debug Rule

skills CLI
$ npx skills add seqra/opentaint --skill debug-rule -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install seqra/opentaint debug-rule --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/debug-rule .claude/skills/debug-rule && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
debug-rule
GitHub stars
162
Token cost
~1.3k tokens
SKILL.md length
700 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
Apache-2.0

At a glance

Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped.

  • Works in 3 steps: Reproduce and localize the kill → Classify the cause → Report the diagnosis
  • Its samples wont pass after repeated attempts
  • SKILL.md covers Inputs, Workflow and Output
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Debug Rule is an agent skill from seqra/opentaint. Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped. Use when its samples won't pass after repeated attempts, or it passes tests but is wrong on a real scan

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis… The licence is Apache-2.0.

When your agent uses it

  • Its samples wont pass after repeated attempts
  • It passes tests but is wrong on a real scan

Example prompts

  • “/debug-rule”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Reproduce and localize the kill
  2. Classify the cause
  3. Report the diagnosis

What it can do on your machine

Read from SKILL.md and the folder at commit f945f92. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Debug Rule loads about 1.3k tokens when it runs. Until then it costs about 51 tokens; SKILL.md has 700 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~51
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seqra/opentaint at commit f945f92, republished under its Apache-2.0 licence (© seqra). 700 words, ~1,274 tokens.

Download SKILL.mdSave it as .claude/skills/debug-rule/SKILL.md (or your agent's skills folder).
name
debug-rule
description
Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped. Use when its samples won't pass after repeated attempts, or it passes tests but is wrong on a real scan
license
Apache-2.0
metadata.author
opentaint
metadata.version
0.3.0

Skill: Debug Rule

Diagnose why a rule or approximation behaves unexpectedly on a model by tracing where taint is dropped, and decide who owns the fix: the rule, a missing library model, or the engine.

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

  • project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
  • rule (required) — the one rule whose sample or flow routes taint through the code under test, as <ruleSetRelativePath>.yaml:<shortId>. For an approximation, the rule whose sample routes taint through the approximated method
  • model (required) — the project model where the behavior shows up

Workflow

1. Reproduce and localize the kill

Reproduce the exact run that showed the problem — same model, rulesets, and applied approximation dirs — and trace where taint dies with a fact-reachability run. Run it directly as a foreground, blocking command and wait for exit — never background it or use Monitor:

bash
opentaint test rule reachability <rule> \
  --project-model <model> \
  -o <results-dir>/report.sarif \
  --ruleset builtin --ruleset .opentaint/rules \
  --passthrough-approximations .opentaint/pass-through \
  --dataflow-approximations .opentaint/dataflow

<results-dir> is .opentaint/test-results/<name> for a test model, .opentaint/results for the main scan. The per-instruction facts are in the sibling <results-dir>/debug-ifds-fact-reachability.sarif, not the -o file — the -o SARIF only shows whether the rule fired. Read that sibling to find the kill:

  • a missed detection (a positive that won't pass, or a flow absent from a scan) — confirm a fact exists at the source; if none, the gap is in pattern-sources, not the flow. Otherwise walk the facts to the last instruction still carrying it and the first where it's gone — that gap is the kill
  • a spurious detection (a negative that fires) — the reverse: find where a fact appears with no tainted input reaching it

Trace the exact run that misbehaved — a different model or ruleset traces something else; taint dying at an approximated call means that approximation isn't propagating. When the flow is missed and the entry method may never be analyzed, rerun with --entry-points "<method-fqn>": a finding that appears only then is an entry-point-discovery problem, not dataflow. On Spring the flag is additive — auto-discovered endpoints stay and your method is added, so use it to force-include an endpoint the analyzer never starts from, not to narrow to one method.

Show full SKILL.md (321 more words)Show less
2. Classify the cause

The killing instruction decides who owns the fix. An engine bug is by far the least likely — assume it last, only once the other two are ruled out; nearly every kill is a missing or wrong library model or a rule defect, both tedious to exclude but far more probable, and the tedium is no reason to jump to "engine". Three outcomes:

  • the kill is at an external library method → a model issue. Cross-check dropped-external-methods.yaml from that run (a --track-external-methods scan regenerates it if absent): listed there means the method is unmodeled — the missing model is the cause, for the approximation stage to model. Not listed but a built-in claims to model it, yet taint dies here → that model is wrong for this case: a passThrough override applies at the rule level, so prefer one for the method; a dataflow override conflicts with built-ins at load, so fall back to a passThrough, or call it an engine issue when only a dataflow shape can express the propagation
  • the kill is where the rule should have matched — a sanitizer misfires, a sink or source variant went unmatched → a rule defect, for rule authoring to fix
  • the kill is a plain instruction the engine must propagate through (assignment, cast, field read, an already-modeled call), with the rule correct and the model complete → an engine issue
3. Report the diagnosis

This skill diagnoses and routes the fix — it doesn't author the rule or approximation, or re-run the pipeline. Report the diagnosis per Output.

Output

Artifacts
  • debug-ifds-fact-reachability.sarif — the per-instruction fact-reachability trace the CLI emits next to the -o SARIF
Summary
  • the diagnosis: file:line and the instruction where taint is killed (or spuriously introduced), and which of the three causes owns the fix
  • for an engine cause: the fact-reachability trace up to the last reachable fact (consumed by the engine-issue report), plus the exact debug command(s) and the model they ran against

© seqra, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/debug-rule of seqra/opentaint.

Open the folder on GitHubat commit f945f92

Compare with similar skills

Debug Rule next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Debug Rule compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Debug Rule this skillseqra/opentaint162—~1.3kAutomated safety check: PassApache-2.0
Codexqa Code Analyzeropenqa-cn/codexqa152—~1.2kAutomated safety check: PassApache-2.0
Static Analysisaftermathlabs/llvm-msvc438—~1.8kAutomated safety check: PassAGPL-3.0
Security Architecture Reviewcbrock84/headcount2k—~1.1kAutomated safety check: PassMIT
Triaging Security Findingsbitwarden/ai-plugins154—~2.2kAutomated safety check: PassCustom licence
Trailmark Graph Evolutiontrailofbits/skills7.4k—~3.4kAutomated safety check: PassCC-BY-SA-4.0

Similar skills

  • Codexqa Code Analyzer

    openqa-cn/codexqa

    Queries a local CodexQA symbol graph for change review, regression scope, test gaps, error location, and entry risk.

    152 GitHub stars~1.2k tokensUpdated 4 days ago
    SecurityAuto-check passed

  • Static Analysis

    aftermathlabs/llvm-msvc

    Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification.

    438 GitHub stars~1.8k tokensUpdated 4 days ago
    SecurityAuto-check passed

  • Security Architecture Review

    cbrock84/headcount

    Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it.

    2k GitHub stars~1.1k tokensUpdated 20 days ago
    SecurityAuto-check passed

  • Triaging Security Findings

    bitwarden/ai-plugins

    Official

    This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work…

    154 GitHub stars~2.2k tokensUpdated yesterday
    SecurityAuto-check passed

  • Trailmark Graph Evolution

    trailofbits/skills

    Official

    Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

    7.4k GitHub stars~3.4k tokensUpdated 5 days ago
    SecurityAuto-check passed

  • Skylos

    duriantaco/skylos

    Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos.

    843 GitHub stars~581 tokensUpdated yesterday
    SecurityAuto-check passed

More from seqra/opentaint

All 16 skills in this repo

  • Analyze External Methods

    seqra/opentaint

    Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks.

    162 GitHub stars~3.2k tokensUpdated today
    Auto-check passed

  • Create Dataflow Approximation

    seqra/opentaint

    Model a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes.

    162 GitHub stars~1.9k tokensUpdated today
    Auto-check passed

  • Orchestrate Stage

    seqra/opentaint

    Run one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins.

    162 GitHub stars~806 tokensUpdated today
    Auto-check passed

  • Appsec Agent

    seqra/opentaint

    Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage.

    162 GitHub stars~2.2k tokensUpdated today
    Auto-check passed

  • Build Project

    seqra/opentaint

    Build a target project into an opentaint project model. An agent skill from seqra/opentaint.

    162 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Create Pass Through Approximation

    seqra/opentaint

    Model a method's taint propagation as a passThrough approximation.

    162 GitHub stars~1.7k tokensUpdated today
    Auto-check passed

Categories

Questions about Debug Rule

What does Debug Rule do?

Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped. Debug Rule is an agent skill from seqra/opentaint. Debug a rule or approximation that behaves unexpectedly by tracing where taint is dropped.

When should I use Debug Rule?

Debug Rule fits situations like: its samples wont pass after repeated attempts; it passes tests but is wrong on a real scan.

How do I install Debug Rule in Claude Code?

Run `npx skills add seqra/opentaint --skill debug-rule -a claude-code`. Or copy the skill folder (skills/debug-rule in seqra/opentaint) into .claude/skills/debug-rule in your project. Claude Code loads it when a task matches its description.

How do I install Debug Rule in Codex?

Run `npx skills add seqra/opentaint --skill debug-rule -a codex`. Or copy the skill folder (skills/debug-rule in seqra/opentaint) into .agents/skills/debug-rule in your project. Codex loads it when a task matches its description.

Can I use Debug Rule in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seqra/opentaint --skill debug-rule -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/debug-rule, .gemini/skills/debug-rule, .github/skills/debug-rule and .opencode/skills/debug-rule in your project.

What does Debug Rule need to run?

SKILL.md names no scripts, command-line tools or credentials: Debug Rule is instructions for the agent only.

Does Debug Rule access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Debug Rule safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Debug Rule use?

Debug Rule is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Debug Rule use?

About 1.3k tokens (SKILL.md is roughly 5.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Debug Rule?

Skills that share tags, products or a category with Debug Rule: Codexqa Code Analyzer (openqa-cn/codexqa, 152 stars), Static Analysis (aftermathlabs/llvm-msvc, 438 stars), Security Architecture Review (cbrock84/headcount, 2k stars) and Triaging Security Findings (bitwarden/ai-plugins, 154 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Debug Rule?

seqra (a GitHub organization) maintains it in seqra/opentaint, which has 162 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: seqra/opentaint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.