flow_skeleton
Trace interprocedural data flows to find guarded sinks and memory lifecycle issues (double-free, use-after-free, leaks) across function call seams.
Instructions
Interprocedural flow skeletons: compose per-function summaries into linear, nesting-aware {control|sink|lifecycle} streams STITCHED across call seams -- the cross-function flow a single-function skeleton cannot show -- then match shape patterns over them. Two skeleton kinds: REACH (a value's guard-nesting down the call chain to a sink; feeds the guarded-vs-unguarded size differential) and TYPESTATE (a pointer's ordered alloc/use/free/escape; feeds double-free / use-after-free / leak). Returns shape-matcher LEADS (not verdicts -- adjudicate with sources_of/reaches). No arg: every lead, source-rooted first. The response is bounded to a lead page and reports graph counts, never the whole graph. Pass function to scope to one entry and kind to filter reach|typestate.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | filter to one skeleton kind | |
| limit | No | ||
| format | No | text (compact, default) | json (structured result page) | |
| offset | No | ||
| function | No | entry function name; scopes skeletons and renders them |