numeric-trust-boundary

From README

Numeric Trust Boundary (CWE-190, CWE-194, CWE-704, CWE-20) What this checks Plain numeric-conversion bugs (parser returns zero on garbage, divide-by-zero, float equality) are correctness issues that standard linters catch. This skill targets the security subset: an untrusted integer (from a string parser, a wire-protocol length field, a JSON number) that flows into a length, size, index, or permission sink without a bounds check on the post-conversion value. Local pattern only — conversion within a function or two of the sink. Vulnerable patterns Sign-extension when a narrow signed value is cast into a width-or-size type — a byte of 0xFF becomes a huge unsigned length. A string-to-integer parser whose error indicator is the same value as legitimate zero, used as an authorization or identity key without checking the parse-failure flag. Width truncation inside a bounds check — the narrowed value passes the check, but the full-width value is used at the sink.