joern SKILL.md skillA
joern from lu1sdv/skillsmd is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add lu1sdv/skillsmd/joern@git:20260516.f0a764ePins git:20260516.f0a764e in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- lu1sdv/skillsmd
- Path
joern/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260516.f0a764e, committed May 16, 2026
- Size
- 6,995 bytes
- Repository stars
- 2
- License
- none declared
Use when auditing code for vulnerabilities, assessing change impact, tracing dataflow, finding callers/callees of a function, mapping a refactor's blast radius, hunting sinks across a large codebase, or needing repeatable interprocedural queries over a Code Property Graph. Triggers: "joern", "CPG", "code property graph", "blast radius", "dataflow", "taint trace", "who calls X", "callgraph", "dead code", "find sinks", "interprocedural".
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Joern Code Property Graph Analysis ## Overview Joern parses source code into a **Code Property Graph (CPG)** — AST + CFG + dataflow merged into one queryable graph. After a one-time build (~30s–several min depending on codebase size), all subsequent queries are interactive and avoid repeated `grep`/`find`/manual call-tracing. **Core principle:** Pay the parse cost once, then ask the same codebase arbitrarily many structural / interprocedural questions instantly. **Companion to CodeQL:** Joern is faster to set up and supports 14+ languages; CodeQL has stronger taint libraries for Java/JS/Python. Use joern for fast structural sweeps, CodeQL for deep canned taint suites. ## When to Use - Pre-refactor: "what breaks if I change this function?" → `blast_radius` - Vuln research: "every call into `Runtime.exec` reachable from an HTTP handler" → `reachableBy` - Unknown codebase: "what are the public entry points / sinks of this module?" - Patch diffing: build CPGs for pre/post commits, query the diff for new sinks - When `grep` is too coarse (catches comments, string literals, false matches) ## When NOT to Use - Single-file question — just `Read` it …
Read the whole file at its exact version.
How to install
mdr add lu1sdv/skillsmd/joern@sha256:3612b6ff703b56c6The line at the top of this page pins the label git:20260516.f0a764e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_dszesvrgbuju46qg)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on May 16, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6995 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
lu1sdv/skillsmd · 2 stars · license none declared · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_dszesvrgbuju46qg GET https://markdownregistry.com/api/v1/resolve?ref=lu1sdv/skillsmd/joern GET https://markdownregistry.com/api/v1/blob/3612b6ff703b56c63d673a04630e1dd0b45132d8bde49c7a385e45e3a0641112
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.