skills.rest
irrit-us
irrit-usOFFICIAL
Explore all skills by this author →
GitHub

joern-analysis

Generates Code Property Graphs and runs CPGQL queries for static code analysis.

Updated May 17, 2026
Search Tags:#static analysis#vulnerability discovery#security audit#taint tracking#code property graph#joern#cpgql
One-click install
npx skills add https://github.com/irrit-us/agent_misc --skill joern-analysis-irrit-us
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: joern-analysis
Source: https://github.com/irrit-us/agent_misc/tree/main/skills/joern-analysis
Command: npx skills add https://github.com/irrit-us/agent_misc --skill joern-analysis-irrit-us

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Manually auditing large codebases for vulnerabilities, data-flow issues, and dangerous function calls is slow and error-prone. This Skill automates static analysis by building a Code Property Graph (CPG) from source code and querying it with CPGQL to find bugs, trace taint flows, and explore call graphs. ## Core Features & Use Cases - CPG Generation: Parses source code in C/C++, Java, Python, JavaScript, Go, Rust, C#, PHP, Ruby, Swift, Kotlin, and binaries into a unified Code Property Graph. - CPGQL Querying: Runs Scala-based queries to find sensitive sinks, trace data flows from sources to sinks, and explore call graphs across files. - Structured Results: Stores query scripts and outputs in an organized .analysis/joern/ directory with JSON and text export options. - Use Case: During a security audit of a C application, generate the CPG, then run a taint-tracking query to find all paths where user input from gets reaches a system call. ## Quick Start Ask the AI to analyze this codebase with Joern and find all calls to dangerous functions like system, exec, and strcpy.

Frequently Asked Questions about joern-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis on source code with Joern?▼

Generate a Code Property Graph with joern-parse, then write CPGQL queries in .sc files and execute them with joern cpg.bin --script query.sc. Results can be piped to output files or exported as JSON.

How to trace data flow from user input to dangerous functions?▼

Define source nodes such as arguments of input functions like gets or scanf, define sink nodes such as arguments of system or exec calls, then run sink.reachableByFlows(source).p to print all taint flows.

What languages does Joern CPG generation support?▼

Joern supports C/C++, Java, Python, JavaScript, Go, Rust, C#, PHP, Ruby, Swift, Kotlin, and binaries. Use --list-languages to see supported languages and --language to force a specific one when auto-detection fails.

Why does joern-parse fail or run out of memory on large codebases?▼

Large codebases exceed the default JVM heap. Increase memory with the -J-Xmx8G flag when running joern-parse or joern, and specify the language explicitly if auto-detection fails.

Can I explore the Code Property Graph interactively?▼

Yes, launch the interactive REPL with joern --import cpg.bin. The joern prompt supports TAB auto-completion on all node types and traversal steps, and accepts full Scala expressions.

Related Skills

Explore More Software Engineering Skills→
ahravahrav
2

archive-full

Package git-tracked source files into a tar.gz archive, excluding binaries and build artifacts.

Community
Basic
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
jassicsjassics
6

sast-review

Triage SAST findings to rank true vulnerabilities and suggest remediation.

Community
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate