# Sensitive Operation Context Analysis Subtask

## Task Mode

Task mode: Run in the background, deliver results, do not allow user questions.

## Task Input

- Sensitive operation location and related description
- Report output path

## Task Items

1. Load task prompts on demand
2. Obtain context analysis guided by prompts
3. Conclusion verification
4. Output analysis report file when a vulnerability exists
5. Return false positive result when no vulnerability exists; do not output a file

## Task Steps

### Step1 Load prompts as required

Load the context analysis method based on the sensitive operation type (required):

  - Sink-type sensitive operations: Load the data flow analysis method `<SKILL root directory>/taint-analyze/task.md`
  - Business logic-type sensitive operations: Load the security control modeling analysis method `<SKILL root directory>/control-analyze/task.md`
  - Configuration-type defects: Output the report directly

Load knowledge bases based on the language, framework, and attack surface involved (for analysis reference only; can be loaded on demand during analysis):

! When loading these 3 knowledge bases, first list the file names in the knowledge base directory and load the needed knowledge based on file names.
- Programming language & features knowledge base: `<SKILL root directory>/knowledge/languages/`
- Framework knowledge base: `<SKILL root directory>/knowledge/frameworks/`
- Attack surface knowledge base (optional): `<SKILL root directory>/knowledge/security/`

### Step2 Strictly follow the analysis method for context analysis

! Strictly follow the analysis method instructions to obtain more code context for analysis.

### Step3 Check conclusions & verify output report

Load `<SKILL root directory>/checklists/report_checklist.md` for report verification.

  - If verification fails, continue analysis and reorganize the report.
  - If verification passes:
    - If the conclusion is that a vulnerability exists, organize the report in the specified JSON format and output to the designated report file output path.
    - If the conclusion is that no vulnerability exists, end the code file audit process and output that no vulnerability was found.

! The audit can only be completed and the final report submitted after passing report verification.
! When a vulnerability analysis is confirmed as a false positive, no report file needs to be output.

## Output Format Requirements

! For sensitive operation risks confirmed as false positives, do not output a report file; return a false positive explanation only.
! Strictly organize the report in the following JSON format; do not output additional thinking content.
! When outputting markdown format content into JSON, be careful to escape double quotes to avoid breaking the JSON structure.
! If there are multiple issues, output multiple JSON files with **auto-numbered** filenames to avoid overwriting.
! If the output file already exists, adjust the output filename to avoid overwriting.

```json
{
    "severity": "High/Medium/Low",
    "title": "Brief title",
    "type": "Static Defect/Security Vulnerability/Logic Defect/Memory Issue",
    "location": "File path:start line-end line",
    "analysis": "Root cause and trigger conditions (Markdown format)",
    "impact": "Business impact and exploitation method (Markdown format)",
    "issue_code": "Problem code snippet",
    "fix_code": "Fix code (optional)"
}
```

The `analysis` field must include the following 3 parts:

1. Vulnerability root cause, exploitation conditions, and trigger method
2. Data/control flow propagation analysis (output mermaid diagram)
Example:
```mermaid
graph TD
    A["/patches/task accepts user input"] --> |HTTP request parameter pack_id| B["PatchController.patches_task"]
    B --> |taint variable data| C["PatchManager.patches_task"]
    C --> |taint variable pack_id| D["PatchManager.patches_task_pre"]
    D --> |taint variable pack_id| E["PatchManager._patches_task"]
    E --> |taint variable pack_id| F["PatchOperateModule.update_value_from_ini"]
    F --> G["utils.execute_shell sed command execution"]
    G --> H["Command injection vulnerability"]
```
3. Key code snippets
For example:
- Route binding location
- Dangerous function
- Validation function
- Authentication/authorization
- Key propagation points
- ...

## Best Practices

- Code search
  - Bad practice: After Grep finds the sensitive operation code line, analyze directly based on the search content.
  - Best practice: After Grep finds the line, read the surrounding code context and clarify the functional logic.
