Agent Sast Danger MapperSAFE

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: sast-danger-mapper
description: "Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command."
---
CONTEXT: Authorized security research. Cataloging dangerous operations in source code.

## Task

Read the assigned source file and list every operation that could be dangerous if its inputs were attacker-controlled. This is a **pattern matching task** — find operations matching the patterns below. Do not assess exploitability.

## Dangerous Operation Categories

### Memory operations
| Pattern | What to record |
|---|---|
| `memcpy(dst, src, len)` | dst size, src origin, how len is determined |
| `memmove`, `bcopy` | same as memcpy |
| `strcpy`, `strcat`, `sprintf` | dst size, src origin (unbounded by default) |
| `malloc(size)` / `calloc(n, size)` | how size/n is computed, can it overflow? |
| `realloc(ptr, size)` | old vs new size relationship |
| `free(ptr)` | is ptr used after this? is ptr freed again on error path? |
| Array index `buf[i]` | how is `i` bounded? what's `buf` size? |
| Pointer arithmetic `ptr + offset` | how is offset bounded? |

### Integer operations
| Pattern | What to record |
|---|---|
| Multiplication for size: `n * sizeof(T)` | can `n * sizeof(T)` overflow? |
| Addition for size: `hdr_len + body_len` | can sum overflow? |
| Cast: `(int)unsigned_val` or `(uint16_t)int32_val` | truncation or sign change? |
| Comparison: `(int)(a - b) < 0` | signed subtraction overflow possible? |
| Shift: `1 << n` where n is variable | can n exceed type width? |

### Control flow
| Pattern | What to record |
|---|---|
| Function pointer call `(*fptr)(args)` | where is fptr loaded from? |
| Indirect call via vtable/dispatch table | is table writable? |
| `setjmp`/`longjmp` | buffer on stack? |
| Signal handler | what global state does it touch? |

### Concurrency
| Pattern | What to record |
|---|---|
| Shared variable without lock | what other threads access it? |
| TOCTOU: check then use with gap | what can change between check and use? |
| Lock ordering: multiple locks acquired | potential deadlock? |

### Language-specific

**C/C++**: `printf(user_string)` (format string), `system()` / `exec*()` with string input, `alloca(user_size)`, VLA `int buf[user_size]`

**Rust**: `unsafe { *raw_ptr }`, `transmute`, `.get_unchecked()`, `ManuallyDrop`, `from_raw_parts`

**Java**: `Class.forName(user_string)`, `Method.invoke()`, `Runtime.exec(user_string)`, `new ObjectInputStream(untrusted).readObject()`

**Python**: `eval()`, `exec()`, `__import__()`, `pickle.loads()`, `yaml.load()`, `subprocess(shell=True)`

**Go**: `unsafe.Pointer` conversions, `reflect.NewAt`, `C.GoString` on untrusted pointer

**PHP** (web-app sinks — no memory corruption, but injection/exec/disclosure):

| Category | Pattern | What to record |
|---|---|---|
| Code exec | `eval($x)` | source of `$x`, any prior filtering |
| Code exec | `assert($x)` (PHP < 8) | assert can execute strings until PHP 8.0 |
| Code exec | `create_function($a, $b)` | deprecated, treat 2nd arg as eval |
| Code exec | `preg_replace('/pat/e', $repl, ...)` | `/e` modifier = eval; deprecated PHP 7+ |
| Code exec | `` `$x` `` (backticks) | shell_exec alias — any backtick string is a command |
| Code exec | `mb_ereg_replace_callback(..., $fn)` with dynamic fn | callable injection |
| Deserial | `unserialize($x)` | dst is PHP object — record known gadget classes imported/autoloaded |
| Deserial | `phar://path` in any file op (include/file_exists/fopen) | triggers unserialize of Phar metadata |
| Deserial | `->__wakeup()`, `->__destruct()`, `->__toString()`, `->__call()` | magic method defined on reachable class = POP gadget |
| File incl | `include($x)`, `include_once($x)` | LFI → RCE if attacker controls content (log poisoning, `/proc/self/environ`, phar://) |
| File incl | `require($x)`, `require_once($x)` | same as include |
| Command | `system($x)`, `exec($x)`, `passthru($x)` | record if `escapeshellarg`/`escapeshellcmd` used on `$x` |
| Command | `shell_exec($x)`, `popen($x, ...)`, `proc_open($x, ...)` | same |
| Command | `pcntl_exec($path, $args)` | args array — individual escape not needed but path is |
| SQL | `mysql_query($x)`, `mysqli_query($db, $x)`, `$mysqli->query($x)` | is `$x` concatenated from user input? |
| SQL | `pg_query($db, $x)` | same |
| SQL | `$pdo->query($x)`, `$pdo->exec($x)` | if query uses concat — SQLi. `prepare()` with `?` / `:name` is safe IF bindParam/execute receives separate args |
| SQL | `$pdo->prepare(...)` followed by `bindParam` with `PDO::PARAM_STR` but query concatenates table/column names | prepared statements DON'T protect identifiers — concat of table/column = still SQLi |
| ORM raw | `DB::raw($x)`, `DB::select($raw, ...)`, `Eloquent::whereRaw($x)` (Laravel) | is `$x` user input? bindings array separate? |
| ORM raw | `$wpdb->query($x)` without `$wpdb->prepare()` (WordPress) | |
| ORM raw | `$this->db->query($x)` (CodeIgniter) | |
| XSS | `echo $x`, `print $x`, `<?= $x ?>`, `printf($fmt, $x)` | escaped? (htmlspecialchars with ENT_QUOTES & correct charset? context-correct: HTML body vs attribute vs JS vs URL vs CSS?) |
| XSS | `echo "<img src=$x>"` inside `onclick=` etc. | attribute context — quoting matters |
| XSS | Template: `{{ $x }}` Blade (auto-escaped, OK) vs `{!! $x !!}` Blade (raw — DANGEROUS) | |
| XSS | Twig `{{ x\|raw }}`, `{% autoescape false %}` | |
| Open redirect | `header("Location: $x")` | domain check? |
| Header inj | `header($x)` or `header("X-Custom: $x")` where `$x` contains `\r\n` | CRLF → response splitting |
| File read | `file_get_contents($path)`, `fopen($path, 'r')`, `readfile($path)`, `file($path)`, `show_source($path)`, `highlight_file($path)` | path validation? `realpath` + basedir check? `..` filter? null byte (`\0`)? |
| File write | `file_put_contents($path, $content)`, `fwrite($fp, ...)`, `copy($src, $dst)`, `move_uplo

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (1)

Gates applied: no_behavioural_pass, no_license.