New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Generate Poc

by seqra in seqra/opentaint

Reproduce a true-positive finding against the running application.

Apache-2.0Auto-check passedSecurity

Install Generate Poc

skills CLI
$ npx skills add seqra/opentaint --skill generate-poc -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install seqra/opentaint generate-poc --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/generate-poc .claude/skills/generate-poc && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
generate-poc
GitHub stars
162
Token cost
~1.5k tokens
SKILL.md length
728 words
Files
2 (incl. references)
Skills in repo
16
Repo updated
First seen
Licence
Apache-2.0

At a glance

Reproduce a true-positive finding against the running application.

  • Works in 4 steps: Start the app → Map the finding to a live request → Write and run the PoC script → …
  • A finding needs dynamic confirmation
  • SKILL.md covers Inputs, Workflow, Output and Tracking, plus 2 more sections
  • Calls docker

What it does

Generate Poc is an agent skill from seqra/opentaint. Reproduce a true-positive finding against the running application. Use when a finding needs dynamic confirmation

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/java.md`).

It sits in Security, covering Static analysis and SAST. The repository describes itself as: The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis… The licence is Apache-2.0.

When your agent uses it

  • A finding needs dynamic confirmation
  • Tasks that involve Static analysis and SAST

Example prompts

  • “/generate-poc”

Requirements

  • Python 3
  • Docker

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Start the app
  2. Map the finding to a live request
  3. Write and run the PoC script
  4. Record the outcome

What it can do on your machine

Read from SKILL.md and the folder at commit f945f92. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • docker

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use docker, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Generate Poc loads about 1.5k tokens when it runs, and up to ~1.6k if it reads all its reference files. Until then it costs about 31 tokens; SKILL.md has 728 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~31
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seqra/opentaint at commit f945f92, republished under its Apache-2.0 licence (© seqra). 728 words, ~1,454 tokens.

Download SKILL.mdSave it as .claude/skills/generate-poc/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
generate-poc
description
Reproduce a true-positive finding against the running application. Use when a finding needs dynamic confirmation
license
Apache-2.0
metadata.author
opentaint
metadata.version
0.3.0

Skill: Generate PoC

Try to dynamically reproduce the vulnerability found by SAST and confirmed statically. Test it on a running instance via a Python script, and record the outcome

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

  • project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
  • language (required) — target language for this project and language-specific instructions
  • finding (required) — the TP finding to reproduce, .opentaint/tracking/findings/<name>.yaml
  • base-url (optional) — the app's base URL when it is already running; otherwise build and start it

Workflow

1. Start the app

Reuse base-url if given. Otherwise build and start the app the way the project expects (possible build and run commands are in the language reference), wait until it's listening (healthy), and note the base URL — the PoC must hit a live instance. When the app needs backing services (DB, broker, cache, …), bring them all up with one docker compose on a shared network rather than starting each by hand, and register it as a single compose entry. Bind the instance to loopback (per Constraints). Once it's listening, register it (per Tracking) so the orchestrator can reap it later.

2. Map the finding to a live request

From the finding's source location find the entry point — the route and method, and the param / header / body field that carries the tainted input — and a payload that drives it to the sink. Some common shapes:

  • SQL injection — ?id=1' OR '1'='1
  • command injection — ?cmd=;cat /etc/passwd
  • path traversal — ?path=../../../etc/passwd
  • XSS — ?q=<script>alert(1)</script>
  • SSRF — ?url=http://169.254.169.254/latest/meta-data/
  • XXE — an XML body with <!ENTITY xxe SYSTEM "file:///etc/passwd">
3. Write and run the PoC script

Write a self-contained Python script to .opentaint/pocs/<name>.py that does any setup (auth, seed state), sends the request, and asserts the observable evidence — so it's re-runnable and self-checking. Run it. Confirmation needs observable proof — e.g. rows returned, file contents, command output, a time delay, an out-of-band callback, an injection-revealing error, and so on.

4. Record the outcome
  • confirmed — the script fired and proved the described vulnerability. Set poc: confirmed and in notes describe the working sequence (setup → request(s) → observed evidence), not just the final request
  • failed — after several attempts you couldn't confirm the finding, or the app/route couldn't be reached. Set poc: failed, save the script, and in notes record the variants you tried and why each didn't fire

Output

Artifacts
  • .opentaint/pocs/<name>.py — the PoC script, kept whether it confirmed or not
  • .opentaint/tracking/findings/<name>.yaml — the finding's poc and notes updated (per Tracking)
  • .opentaint/tracking/poc-servers.yaml — the started instance registered, left running for reuse (per Tracking)
Show full SKILL.md (282 more words)Show less
Summary
  • the outcome (confirmed / failed) and, if failed, that the finding is unconfirmed; the base URL when you started an instance

Tracking

This skill writes only the finding's poc (confirmed / failed) and the outcome appended to notes; it never changes verdict or the other finding fields. When it starts an app instance it appends one entry to the server registry, and stops there — teardown isn't its job.

.opentaint/tracking/findings/<name>.yaml — one finding, bundling one rule's SARIF results and carrying it through triage and PoC. A script seeds each file from the scan — its sarif_hashes, rule_id, and the analyzer report in notes. Triage sets verdict and appends its reasoning. The PoC stage sets poc and appends its outcome. Keep it clear from comments

yaml
sarif_hashes: [a1b2c3d4, e5f6a7b8]
rule_id: <language>/security/sql-injection.yaml:sql-injection
verdict: TP
notes: >
  <analyzer report for these results — seeded from the scan>
  triage: the request's order field is attacker-controlled and reaches raw query construction → TP
  poc: a crafted order value produced the expected database delay → confirmed
poc: confirmed

.opentaint/tracking/poc-servers.yaml — the registry of app instances started for PoCs, read by the orchestrator to tear them down. One entry per instance: kind (process | container | compose), port, and the matching ref (a pid, a container id/name, or a compose file path) that gives the stop command. PoCs run one at a time, so appends never race. Keep it clear from comments

yaml
servers:
  - kind: process
    port: 8080
    ref: "12345"

Constraints

  • Bind a started instance to loopback (or a specific IP the test genuinely needs), never 0.0.0.0 or a public interface — a live exploit must stay off-host
  • Don't stop an instance you started, and always register it — the orchestrator owns teardown and can only reap what's in .opentaint/tracking/poc-servers.yaml
  • The outcome goes in the finding file only — never write .opentaint/vulnerabilities.md

Gotchas

  • Reproduce, don't theorize — a script you didn't run, or a 200 with no observable effect, is not a confirmation
  • failed ≠ false positive — couldn't-reproduce isn't proof the code is safe (auth, missing state, wrong payload). Record failed and DO NOT flip verdict here

© seqra, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/generate-poc of seqra/opentaint.

  • SKILL.md
  • references/java.md

Open the folder on GitHubat commit f945f92

Compare with similar skills

Generate Poc next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Generate Poc compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Generate Poc this skillseqra/opentaint162—~1.5kAutomated safety check: PassApache-2.0
Semgrepvigolium/piolium1381 repos~2.4kAutomated safety check: NotesMIT
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner286—~6.2kAutomated safety check: PassNone
Sast SemgrepAgentSecOps/SecOpsAgentKit2192 repos~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    138 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated 5 days ago
    SecurityAuto-check: notes

  • LLM Sast Scanner

    SunWeb3Sec/llm-sast-scanner

    General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

    286 GitHub stars~6.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    219 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Wp Phpstan

    Automattic/agent-skills

    A skill your agent uses when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and…

    211 GitHub starsUsed in 1 repo~1k tokens
    SecurityAuto-check passed

More from seqra/opentaint

All 16 skills in this repo

  • Analyze External Methods

    seqra/opentaint

    Analyze an OpenTaint scan's dropped external methods and decide which of them are propagators and optionally sinks.

    162 GitHub stars~3.2k tokensUpdated today
    Auto-check passed

  • Create Dataflow Approximation

    seqra/opentaint

    Model a method's taint propagation as code-based dataflow approximation and refine it against a test project until the sample passes.

    162 GitHub stars~1.9k tokensUpdated today
    Auto-check passed

  • Orchestrate Stage

    seqra/opentaint

    Run one stage of the OpenTaint pipeline by coordinating leaf subagents and deterministic joins.

    162 GitHub stars~806 tokensUpdated today
    Auto-check passed

  • Appsec Agent

    seqra/opentaint

    Run an end-to-end OpenTaint application-security analysis while owning the long project build and scans and delegating each other pipeline stage.

    162 GitHub stars~2.2k tokensUpdated today
    Auto-check passed

  • Build Project

    seqra/opentaint

    Build a target project into an opentaint project model. An agent skill from seqra/opentaint.

    162 GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Create Pass Through Approximation

    seqra/opentaint

    Model a method's taint propagation as a passThrough approximation.

    162 GitHub stars~1.7k tokensUpdated today
    Auto-check passed

Categories

Questions about Generate Poc

What does Generate Poc do?

Reproduce a true-positive finding against the running application. Generate Poc is an agent skill from seqra/opentaint. Reproduce a true-positive finding against the running application.

When should I use Generate Poc?

Generate Poc fits situations like: A finding needs dynamic confirmation; tasks that involve Static analysis and SAST.

How do I install Generate Poc in Claude Code?

Run `npx skills add seqra/opentaint --skill generate-poc -a claude-code`. Or copy the skill folder (skills/generate-poc in seqra/opentaint) into .claude/skills/generate-poc in your project. Claude Code loads it when a task matches its description.

How do I install Generate Poc in Codex?

Run `npx skills add seqra/opentaint --skill generate-poc -a codex`. Or copy the skill folder (skills/generate-poc in seqra/opentaint) into .agents/skills/generate-poc in your project. Codex loads it when a task matches its description.

Can I use Generate Poc in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seqra/opentaint --skill generate-poc -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/generate-poc, .gemini/skills/generate-poc, .github/skills/generate-poc and .opencode/skills/generate-poc in your project.

What does Generate Poc need to run?

Going by SKILL.md and its folder, Generate Poc needs the command-line tools its instructions call (docker). Our summary lists: Python 3; Docker.

Does Generate Poc access the network?

SKILL.md contains no URLs. Its commands use docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Generate Poc safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Generate Poc use?

Generate Poc is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Generate Poc use?

About 1.5k tokens (SKILL.md is roughly 5.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 159 tokens, read only when the agent opens those files.

What are the alternatives to Generate Poc?

Skills that share tags, products or a category with Generate Poc: Semgrep (vigolium/piolium, 138 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Generate Poc?

seqra (a GitHub organization) maintains it in seqra/opentaint, which has 162 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: seqra/opentaint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.