Codeql
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow...
Install
npx skills add trailofbits/skills --skill codeql -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Security
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- Yes, review before use
What it does
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.
CodeQL Analysis
Supported languages: Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, Swift.
Skill resources: Reference files and templates are located at {baseDir}/references/ and {baseDir}/workflows/.
Essential Principles
-
Database quality is non-negotiable. A database that builds is not automatically good, a cached build extracts nothing while reporting success.
-
Data extensions catch what CodeQL misses. Django, Spring, and Express projects still wrap database calls, request parsing, and shell execution in project-specific APIs that no shipped model covers.
-
Explicit suite references prevent silent query dropping. Never pass pack names to
codeql database analyze, each pack'sdefaultSuiteFileapplies hidden filters that can produce zero results. Always generate a.qls. -
Zero findings needs investigation, not celebration. It can mean poor extraction, missing models, the wrong packs, or suite filtering. Run
{baseDir}/scripts/check_db_quality.pyafter the build, confirm{baseDir}/scripts/verify_query_suite.pyexited zero for the suite in use, the generation scripts run it, so invoke it by hand only for a reused or hand-edited suite, and say in the report that both passed. -
macOS Apple Silicon requires workarounds for compiled languages. Exit code 137 is an
arm64e/arm64mismatch, not a build failure. Try Homebrew arm64 tools or Rosetta before falling back tobuild-mode=none. -
Follow workflows step by step. Each phase gates the next; skipping quality assessment or data extensions leaves the gap invisible in the results.
