domains / families / security / sast-rce

sast-rce

authentic

Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md. Use when asked to find RCE, command injection, or unsafe deserialization bugs.

When to use

• find RCE bugs
• command injection detection
• unsafe deserialization detection
• eval-like sink tracing
• OS command injection analysis

When not to use

• SSRF
• Path Traversal
• SSTI
• XSS
• SQL Injection
• Safe subprocess list-form calls
• Safe deserialization

Skill page

Source