flow_skeleton
Generate interprocedural call streams across call boundaries to reveal cross-function control, taint, and pointer-lifecycle flows, then match shape patterns for guarded, double-free, use-after-free, and leak leads.
Instructions
Interprocedural flow skeletons: compose per-function summaries into linear, nesting-aware {control|sink|lifecycle} streams STITCHED across call seams -- the cross-function flow a single-function skeleton cannot show -- then match shape patterns over them. Two skeleton kinds: REACH (a value's guard-nesting down the call chain to a sink; feeds the guarded-vs-unguarded size differential) and TYPESTATE (a pointer's ordered alloc/use/free/escape; feeds double-free / use-after-free / leak). Returns shape-matcher LEADS (not verdicts -- adjudicate with sources_of/reaches). No arg: every lead, source-rooted first. Pass function to scope to one entry and see its rendered skeletons; kind to filter reach|typestate.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | filter to one skeleton kind | |
| limit | No | ||
| format | No | text (compact, default) | json (structured result page) | |
| offset | No | ||
| function | No | entry function name; scopes skeletons and renders them |