Run Scan

Skill: Run Scan

Run an OpenTaint scan over a project and collect results

Inputs

From the caller; if omitted, fall back to the default. Ask only when a required input is missing and has no sensible default

• Target <model-dir> / <project-src> — pre-compiled model or source project directory. Default: model at .opentaint/project
• Ruleset <rules-dir> — Default: builtin plus .opentaint/rules if present
• Rule IDs <full-id> (optional) — full IDs to restrict the scan to, omit to run all loaded rules
• SARIF output <report.sarif> — Default: .opentaint/results/report.sarif
• PassThrough config <config-dir> (optional) — a passThrough YAML file or a directory of them. Default: .opentaint/pass-through
• Dataflow approximations directory <approx-dir> (optional) — Default: .opentaint/dataflow

Workflow

Point at the code either way: a source project (CLI compiles it) as the positional scan <project-src>, or a pre-built model via --project-model <model-dir>. If project model provided prefer using it instead of source project

opentaint scan --project-model <model-dir> \
  -o <report.sarif> \
  --ruleset builtin --ruleset <rules-dir> \
  --track-external-methods

Append optional flags as needed:

• --rule-id <full-id> — restrict to specific rules (repeatable); omit to run all loaded rules
• --passthrough-approximations <config-dir> — apply passThrough configs from a YAML file or a directory of them (OVERRIDE: merged with built-ins at the rule level, a provided rule overrides a built-in only when it matches one; repeatable)
• --dataflow-approximations <approx-dir> — apply code-based approximations (Java sources, auto-compiled; or pre-compiled .class dirs, passed through as-is)

Output

Three files, all next to the SARIF report:

1. <report.sarif> — findings with code-flow traces 2. dropped-external-methods.yaml — methods where dataflow facts were killed (no approximation model) → candidates to approximate; possible source of false negatives 3. approximated-external-methods.yaml — methods already modeled

Key Flags

Gotchas

• Paths fall back to the .opentaint/ layout when the caller omits them; the caller can override any of them
• Duplicate approximation targeting the same class as a built-in errors out