From hydra-reach-filter
Post-filters vuln-detector findings by call-graph reachability from an entrypoint, so operators triage exploitable vulns first and dead-code or vendored-library hits last. Use when the developer wants to triage a vuln-detector audit.jsonl, runs /hydra:reach, asks "which of these findings are actually reachable?", or references Snyk/CodeQL/Semgrep reachability as a reference baseline. Currently scaffolded; full integration is blocked on lich exporting a persisted call-graph artifact — in graph-absent mode, every finding is preserved with reachable=null. Do not use for raw vuln scanning (see vuln-detector) or for first-pass CWE classification (see audit-trail).
How this skill is triggered — by the user, by Claude, or both
Slash command
/hydra-reach-filter:reach-awarenesshaikuThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
- `vuln-detector` has run and produced `state/audit.jsonl` with at least
vuln-detector has run and produced state/audit.jsonl with at least
one vuln_detected event.README.md
exists (or the operator accepts graph-absent mode, where every finding is
passed through with reachable=null).| Flag | Default | Meaning |
|---|---|---|
--audit | ../vuln-detector/state/audit.jsonl | Source of vuln_detected events |
--graph | (none) | Path to call-graph JSON; absent = graph-absent mode |
--out | state/reach-filtered.jsonl | Output path |
Read. Confirm at least one row has
event == "vuln_detected".--graph resolves to an existing file. If not, run in
graph-absent mode and document the reason in the summary stderr line.python scripts/reach-filter.py with the resolved flags. Stream
stdout/stderr; the summary line on stderr is the human-readable verdict.python scripts/explain-reach.py --finding-id <id>.state/reach-filtered.jsonl — one JSON object per input finding, plus
reachable, distance_from_entry, path.vuln-detector raw=N | reachable=M | filtered_unreachable=N-MThe filtered output is what an operator hands to triage. The raw
vuln-detector audit.jsonl remains the source of truth — this plugin is
advisory.
reachable MUST be null, never false.grep/find to walk the audit file. Counter: stdlib
json per line; the file is JSONL by contract.Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub enchanter-ai/hydra --plugin reach-filter