You might be interested in Capslock, which attempts to do that through static analysis. https://security.googleblog.com/2023/09/capslock-what-is-you...