# Security Dossier

> Build comprehensive security context dossiers for functions in DeepExtractIDA binaries -- gathering identity, attack reachability, data flow exposure, dangerous operations, resource patterns, complexity metrics, and neighboring context in one command. Use when the user asks to audit a function's security posture, build a security dossier, assess attack surface, check function reachability from ex…

- **Type:** Skill
- **Install:** `agentstack add skill-marcosd4h-deepextractruntime-security-dossier`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [marcosd4h](https://agentstack.voostack.com/s/marcosd4h)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [marcosd4h](https://github.com/marcosd4h)
- **Source:** https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/security-dossier

## Install

```sh
agentstack add skill-marcosd4h-deepextractruntime-security-dossier
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Context Dossier

## Purpose

One-command deep context gathering for security auditing. Before manually reviewing a decompiled function, the researcher needs to understand its security landscape. This skill builds a comprehensive dossier covering:

1. **Function Identity** -- Name, signature, class membership, mangled name
2. **Attack Reachability** -- Exported? Entry point? Reachable from exports? Shortest path from entry? + RPC/COM/WinRT IPC entry points
3. **Untrusted Data Exposure** -- Which export callers can feed external data? How many hops? + parameter risk scoring
4. **Dangerous Operations** -- Direct dangerous APIs, security-relevant callees by category, callee-depth analysis + BFS transitive to configurable depth
5. **Resource Patterns** -- Synchronization, memory operations, global variable reads/writes
6. **Complexity Assessment** -- Instructions, branches, loops, cyclomatic complexity, stack frame
7. **Neighboring Context** -- Class methods, direct callees/callers
8. **Data Quality** -- Extraction-time error warnings

## Data Sources

- **Individual analysis DBs** (`extracted_dbs/{module}_{hash}.db`): Function records, xrefs, assembly, loop analysis, stack frame, dangerous APIs, global accesses
- **Tracking DB** (`extracted_dbs/analyzed_files.db`): Module name to DB path mapping
- **Exports/Entry points**: From `file_info` table in individual DBs
For DB schema details, see [data_format_reference.md](../../docs/data_format_reference.md).

### Finding a Module DB

```bash
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
```

### Quick Cross-Dimensional Search

To search across function names, signatures, strings, APIs, classes, and exports in one call:

```bash
python .claude/helpers/unified_search.py  --query "SearchTerm"
python .claude/helpers/unified_search.py  --query "SearchTerm" --json
```

## Utility Scripts

All scripts are in `scripts/`. Run from the workspace root.

### build_dossier.py -- Build Security Dossier (Start Here)

Single command to produce the full dossier:

```bash
# By function name
python .claude/skills/security-dossier/scripts/build_dossier.py  

# By function ID
python .claude/skills/security-dossier/scripts/build_dossier.py  --id 

# Search for functions matching a pattern
python .claude/skills/security-dossier/scripts/build_dossier.py  --search 

# JSON output (machine-readable)
python .claude/skills/security-dossier/scripts/build_dossier.py   --json

# Deeper callee analysis (check callees' callees for dangerous APIs)
python .claude/skills/security-dossier/scripts/build_dossier.py   --callee-depth 4
```

Examples:

```bash
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/appinfo_dll_e98d25a9e8.db AiCheckSecureApplicationDirectory
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/cmd_exe_6d109a3a00.db --search "BatLoop"
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/cmd_exe_6d109a3a00.db BatLoop --json
```

## Workflows

```
Security Dossier Progress:
- [ ] Step 1: Find the module DB
- [ ] Step 2: Build the dossier
- [ ] Step 3: Review the dossier sections
- [ ] Step 4: Deep dive into flagged areas
```

**Step 1**: Find the Module DB

```bash
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
```

**Step 2**: Build the Dossier

```bash
python .claude/skills/security-dossier/scripts/build_dossier.py  
```

**Step 3**: Review the Dossier

Focus on these high-priority indicators:

| Indicator                        | Meaning                                                          |
| -------------------------------- | ---------------------------------------------------------------- |
| **Externally Reachable = YES**   | Function can be triggered from outside the module                |
| **Direct Dangerous APIs**        | Immediate dangerous behavior (memory-unsafe, command exec, etc.) |
| **Security-Relevant Callees**    | Sensitive operations performed via callees                       |
| **Receives External Data = YES** | Untrusted data can flow to this function                         |
| **Global Writes**                | State mutation affecting other functions                         |
| **High Cyclomatic Complexity**   | Complex control flow, higher bug probability                     |

**Step 4**: Deep Dive

Based on dossier findings, use complementary skills:

- **Code extraction** -- extract the function for detailed review:

```bash
python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py  
```

- **Call graph tracing** -- follow execution paths across modules:

```bash
python .claude/skills/callgraph-tracer/scripts/chain_analysis.py   --depth 3
```

## Dossier Section Reference

### 1. Function Identity

Source: `functions` table -- `function_name`, `function_signature`, `function_signature_extended`, `mangled_name`. Class membership inferred from `::` in the function name.

**Library tag**: When available, `lookup_function()` from helpers provides the function's library tag (WIL/STL/WRL/CRT/ETW) and `.cpp` source file path.

### 2. Attack Reachability

Source: `file_info.exports`, `file_info.entry_point`, `simple_inbound_xrefs`. BFS upward through callers to find paths from exports/entry points. Reports whether the function is externally reachable and the shortest path from an entry point. Also includes `ipc_context` with ground-truth RPC/COM/WinRT classification from `rpc_index`, `com_index`, and `winrt_index` helper modules.

### 3. Untrusted Data Exposure

Combines reachability with exports analysis. Functions reachable from exports may receive untrusted external input. Traces data paths from export callers to the target. Now includes `param_surface` (structured metadata) from signature analysis, and considers entry points and IPC handlers as data sources alongside exports.

### 4. Dangerous Operations

Source: `dangerous_api_calls` (direct), `simple_outbound_xrefs` classified by security API category. Uses BFS via CallGraph to `--callee-depth` (default 4) for transitive dangerous API discovery. Also reports `indirect_calls` from detailed `outbound_xrefs`. Categories: memory_unsafe, command_execution, code_injection, privilege, file_write, registry_write, network, crypto, sync, memory_alloc.

### 5. Resource Patterns

Source: `simple_outbound_xrefs` classified for sync/memory/file APIs. `global_var_accesses` for global state reads/writes.

### 6. Complexity Assessment

Source: `assembly_code` (instruction/branch/call counts), `loop_analysis` (loop count, cyclomatic complexity), `stack_frame` (sizes, exception handler). Includes `has_syscall` for direct syscall detection.

### 7. Neighboring Context

Source: Functions sharing the same `ClassName::` prefix. Direct callees/callers from xrefs.

## Direct Helper Module Access

For programmatic use without skill scripts:

- `helpers.classify_api_security(api_name)` -- Classify API for security relevance
- `helpers.get_dangerous_api_set()` -- Get the set of known dangerous APIs
- `helpers.CallGraph.from_functions(functions)` -- Build call graph for reachability analysis
- `helpers.resolve_function(db, name_or_id)` -- Resolve function by name or ID

## Integration with Other Skills

| Task | Recommended Skill |
|------|-------------------|
| Trace call chains from audited functions | callgraph-tracer |
| Classify functions in the audit neighborhood | classify-functions |
| Map entry points reachable from audited function | map-attack-surface |
| Lift audited functions to clean code for review | batch-lift |

## Performance

| Operation | Typical Time | Notes |
|-----------|-------------|-------|
| Build single function dossier | ~5-10s | Gathers from multiple skills |
| Build dossier (deep callee scan) | ~15-45s | With --callee-depth 4+ (BFS) |

## Additional Resources

- For detailed technical reference, see [reference.md](reference.md)
- For DB schema and JSON formats, see [data_format_reference.md](../../docs/data_format_reference.md)
- For file_info.json schema, see [file_info_format_reference.md](../../docs/file_info_format_reference.md)
- For call graph tracing, see [callgraph-tracer](../callgraph-tracer/SKILL.md)
- For function classification, see [classify-functions](../classify-functions/SKILL.md)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [marcosd4h](https://github.com/marcosd4h)
- **Source:** [marcosd4h/DeepExtractRuntime](https://github.com/marcosd4h/DeepExtractRuntime)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-marcosd4h-deepextractruntime-security-dossier
- Seller: https://agentstack.voostack.com/s/marcosd4h
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.