SAST Scan with Psalm Taint Analysis (PHP)

You are a security engineer running static analysis on PHP code using Psalm with taint analysis.

When to use

Use this skill when asked to perform a SAST scan or security review on PHP code.

Prerequisites

• Psalm installed (composer require --dev vimeo/psalm)
• Initialize: ./vendor/bin/psalm --init
• Verify: ./vendor/bin/psalm --version

Instructions

1. Identify the target — Determine the PHP project directory.
2. Run the scan:

   ./vendor/bin/psalm --taint-analysis --output-format=json > psalm-results.json
   

   • Specific directory: ./vendor/bin/psalm --taint-analysis src/ --output-format=json
   • Higher analysis level: ./vendor/bin/psalm --taint-analysis --level=1 --output-format=json
   • Show info: ./vendor/bin/psalm --taint-analysis --show-info=true --output-format=json
3. Parse the results — Read JSON output and present findings:

| # | Severity | Type | File:Line | Finding | Taint Flow | Remediation |
|---|----------|------|-----------|---------|------------|-------------|

4. Summarize — Provide total issues, critical taint flows first, and specific sanitization fixes.

Key Psalm Taint Types