Agent skill

Run Scan

Run an OpenTaint scan on project and produces the SARIF report.

Apache-2.0Auto-check passedSecurity

Install Run Scan

skills CLI

$ npx skills add seqra/opentaint --skill run-scan -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install seqra/opentaint run-scan --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/run-scan .claude/skills/run-scan && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "run-scan" agent skill from https://github.com/seqra/opentaint/tree/main/skills/run-scan into .claude/skills/run-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "run-scan", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/seqra/opentaint/tree/main/skills/run-scan

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add seqra/opentaint --skill run-scan -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install seqra/opentaint run-scan --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/run-scan .agents/skills/run-scan && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "run-scan" agent skill from https://github.com/seqra/opentaint/tree/main/skills/run-scan into .agents/skills/run-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "run-scan", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add seqra/opentaint --skill run-scan -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install seqra/opentaint run-scan --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/run-scan .cursor/skills/run-scan && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "run-scan" agent skill from https://github.com/seqra/opentaint/tree/main/skills/run-scan into .cursor/skills/run-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "run-scan", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/seqra/opentaint.git --path skills/run-scan

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add seqra/opentaint --skill run-scan -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install seqra/opentaint run-scan --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/run-scan .gemini/skills/run-scan && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "run-scan" agent skill from https://github.com/seqra/opentaint/tree/main/skills/run-scan into .gemini/skills/run-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "run-scan", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install seqra/opentaint run-scan

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add seqra/opentaint --skill run-scan -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/run-scan .github/skills/run-scan && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "run-scan" agent skill from https://github.com/seqra/opentaint/tree/main/skills/run-scan into .github/skills/run-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "run-scan", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add seqra/opentaint --skill run-scan -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install seqra/opentaint run-scan --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/seqra/opentaint.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/run-scan .opencode/skills/run-scan && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "run-scan" agent skill from https://github.com/seqra/opentaint/tree/main/skills/run-scan into .opencode/skills/run-scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "run-scan", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: run-scan
GitHub stars: 162
Token cost: ~1.1k tokens
SKILL.md length: 564 words
Files: 1
Skills in repo: 16
Repo updated: Oct 7, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Run an OpenTaint scan on project and produces the SARIF report.

Works in 3 steps: Run the scan → Retry once on out-of-memory → Collect the report, or escalate
The user asks to scan
SKILL.md covers Inputs, Workflow, Output and Constraints
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Run Scan is an agent skill from seqra/opentaint. Run an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis… The licence is Apache-2.0.

When your agent uses it

The user asks to scan
Re-scan a project

Example prompts

“/run-scan”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

Run the scan
Retry once on out-of-memory
Collect the report, or escalate

What it can do on your machine

Read from SKILL.md and the folder at commit f945f92. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Run Scan loads about 1.1k tokens when it runs. Until then it costs about 32 tokens; SKILL.md has 564 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~32
When it runs · the whole SKILL.md, loaded when a task matches: ~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seqra/opentaint at commit f945f92, republished under its Apache-2.0 licence (© seqra). 564 words, ~1,093 tokens.

Download SKILL.mdSave it as .claude/skills/run-scan/SKILL.md (or your agent's skills folder).

name: run-scan
description: Run an OpenTaint scan on project and produces the SARIF report. Use whenever the user asks to scan or re-scan a project
license: Apache-2.0
metadata.author: opentaint
metadata.version: 0.3.0

Skill: Run Scan

Run an OpenTaint scan over the project model and collect its findings

Inputs

Provided by the caller, fall back to the default value when omitted. Ask back only when a required input is missing and has no sensible default

project-root (optional) — root of the target project. Opentaint keeps all analysis artifacts under the fixed <project-root>/.opentaint/ directory, so every .opentaint/... path below resolves there. Default: current directory
rule-ids (optional) — full rule IDs to restrict the scan to
max-memory (optional) — a --max-memory value to run scan with. Default: unset (engine default 8G)

Workflow

1. Run the scan

Scan the pre-built model at .opentaint/project. Write the report to .opentaint/results/report.sarif and load both the built-in ruleset and the project's own rules under .opentaint/rules:

bash

opentaint scan --project-model .opentaint/project \
  -o .opentaint/results/report.sarif \
  --ruleset builtin --ruleset .opentaint/rules \
  --track-external-methods

--rule-id <full-id> — restrict to specific executable rules (repeatable, one per input rule ID); referenced library rules remain available without listing their IDs separately. Omit to run all loaded rules
--passthrough-approximations .opentaint/pass-through — add when that directory exists: passThrough configs override built-ins at the rule level, a provided rule overriding a built-in only when it matches one
--dataflow-approximations .opentaint/dataflow — add when that directory exists: code-based approximations (sources auto-compiled; pre-compiled .class dirs passed through as-is)

Both approximation-dir flags walk their trees recursively; pass each parent directory once, not every package or batch separately.

The scan is long — run it in the background and wait for it to finish. Leave --timeout at the engine default (900s); the CLI ends the analysis itself and writes whatever SARIF it has.

2. Retry once on out-of-memory

Start at the 8G default. An out-of-memory failure at 8G — even when the engine still wrote a partial SARIF — is not an acceptable result: retry once at --max-memory 16G before collecting anything. Never higher (more RAM won't improve results), one bump only. When the caller passed max-memory, run at it from the first attempt instead

Show full SKILL.md (258 more words)Show less

3. Collect the report, or escalate

A SARIF is complete enough to use even alongside the two normal scan errors — a timeout (the CLI ended the analysis and wrote what it had), or an out-of-memory at 16G (after §2's bump), take it as-is. The other two outcomes are not results to accept. A config-load failure on a malformed approximation is fixed, not bumped: report the engine error and the offending file under .opentaint/pass-through/.opentaint/dataflow per Output so it can be repaired and rescanned. No SARIF at all, even at 16G, is a plain failure: report it per Output with the scan setup.

Output

Short and concise report of what was done

Artifacts:

All three sit next to the report under .opentaint/results/:

.opentaint/results/report.sarif — findings with code-flow traces
.opentaint/results/dropped-external-methods.yaml — external methods where dataflow facts were killed for lack of a model
.opentaint/results/approximated-external-methods.yaml — external methods already modeled

Summary:

finding count, and dropped-vs-approximated external-method counts
whether memory was bumped to 16G
if the scan failed at config-load on a malformed approximation: the engine error and the offending file under .opentaint/pass-through or .opentaint/dataflow (located from the error), so it can be fixed and rescanned — this is not an out-of-memory failure and 16G won't help
if no SARIF came out even at 16G: that the scan is left failed, with the setup used (full scan command with ruleset, approximation dirs, model)

Constraints

Never hand-edit the project model to change scan results — this skill only reads it. If the model is wrong, rebuild it at the model stage rather than patching project.yaml or anything under it

Files

Just SKILL.md in skills/run-scan of seqra/opentaint.

Open the folder on GitHubat commit f945f92

Compare with similar skills

Run Scan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Run Scan compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Run Scan this skillseqra/opentaint	162	—	~1.1k	Automated safety check: Pass	Apache-2.0	today
Semgrepvigolium/piolium	138	1 repos	~2.4k	Automated safety check: Notes	MIT	17 days ago
C To AstNarwhal-Lab/MagicSkills	316	—	~1.1k	Automated safety check: Pass	MIT	6 mo ago
Semgrep Security Scantrailofbits/skills	7.4k	—	~3.7k	Automated safety check: Notes	CC-BY-SA-4.0	5 days ago
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner	286	—	~6.2k	Automated safety check: Pass	None	1 mo ago
Sast SemgrepAgentSecOps/SecOpsAgentKit	219	2 repos	~2.4k	Automated safety check: Pass	Custom licence	5 mo ago

Similar skills

Semgrep
vigolium/piolium
Run Semgrep static analysis scan on a codebase using parallel subagents.
138 GitHub starsUsed in 1 repo~2.4k tokens
SecurityAuto-check: notes
C To Ast
Narwhal-Lab/MagicSkills
Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.
316 GitHub stars~1.1k tokensUpdated 6 mo ago
SecurityAuto-check passed
Semgrep Security Scan
trailofbits/skills
Official
Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.
7.4k GitHub stars~3.7k tokensUpdated 5 days ago
SecurityAuto-check: notes
LLM Sast Scanner
SunWeb3Sec/llm-sast-scanner
General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.
286 GitHub stars~6.2k tokensUpdated 1 mo ago
SecurityAuto-check passed
Sast Semgrep
AgentSecOps/SecOpsAgentKit
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.
219 GitHub starsUsed in 2 repos~2.4k tokens
SecurityAuto-check passed
Wp Phpstan
Automattic/agent-skills
A skill your agent uses when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and…
211 GitHub starsUsed in 1 repo~1k tokens
SecurityAuto-check passed

Questions about Run Scan

What does Run Scan do?

Run an OpenTaint scan on project and produces the SARIF report. Run Scan is an agent skill from seqra/opentaint. Run an OpenTaint scan on project and produces the SARIF report.

When should I use Run Scan?

Run Scan fits situations like: the user asks to scan; re-scan a project.

How do I install Run Scan in Claude Code?

Run `npx skills add seqra/opentaint --skill run-scan -a claude-code`. Or copy the skill folder (skills/run-scan in seqra/opentaint) into .claude/skills/run-scan in your project. Claude Code loads it when a task matches its description.

How do I install Run Scan in Codex?

Run `npx skills add seqra/opentaint --skill run-scan -a codex`. Or copy the skill folder (skills/run-scan in seqra/opentaint) into .agents/skills/run-scan in your project. Codex loads it when a task matches its description.

Can I use Run Scan in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seqra/opentaint --skill run-scan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/run-scan, .gemini/skills/run-scan, .github/skills/run-scan and .opencode/skills/run-scan in your project.

What does Run Scan need to run?

SKILL.md names no scripts, command-line tools or credentials: Run Scan is instructions for the agent only.

Does Run Scan access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Run Scan safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Run Scan use?

Run Scan is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Run Scan use?

About 1.1k tokens (SKILL.md is roughly 4.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Run Scan?

Skills that share tags, products or a category with Run Scan: Semgrep (vigolium/piolium, 138 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Run Scan?

seqra (a GitHub organization) maintains it in seqra/opentaint, which has 162 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on October 7, 2026.

Source: seqra/opentaint on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Run Scan

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Skill: Run Scan

Inputs

Workflow

1. Run the scan

2. Retry once on out-of-memory

3. Collect the report, or escalate

Output

Artifacts:

Summary:

Constraints

Files

Compare with similar skills

Similar skills

More from seqra/opentaint

Related

Questions about Run Scan