codeql
codeql
What it does
- If the user specifies an output directory in their prompt, use it as OUTPUTDIR.
- If not specified, default to ./staticanalysiscodeql1. If that already exists, increment to 2, 3, etc.
- Inside $OUTPUTDIR: find "$OUTPUTDIR" -maxdepth 2 -name "codeql-database.yml"
- Scanning a codebase for security vulnerabilities with deep data flow analysis
- Building a CodeQL database from source code (with build capability for compiled languages)
- Finding complex vulnerabilities that require interprocedural taint tracking or AST/CFG analysis
- Performing comprehensive security audits with multiple query packs
Requirements & configuration
- Finding complex vulnerabilities that require interprocedural taint tracking or AST/CFG analysis
Configuration: OUTPUT_DIRUSER_SPECIFIED_DIRFOUND_DBSCODEQL_LANGCREATEDDB_NAME
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
codeql FAQ
What does the codeql skill do?
>- Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output. If the user specifies an output directory in their prompt, use it as OUTPUTDIR. If not specified, default to ./staticanalysiscodeql1. If that already exists, increment to 2, 3, etc.
What does codeql require?
Finding complex vulnerabilities that require interprocedural taint tracking or AST/CFG analysis Configuration keys: OUTPUT_DIR, USER_SPECIFIED_DIR, FOUND_DBS, CODEQL_LANG, CREATED, DB_NAME.
How do I install codeql?
Run: npx -y skills add https://github.com/trailofbits/skills --skill codeql --agent claude-code — the source lives at github.com/trailofbits/skills.
Maintain codeql?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/trailofbits-skills-codeql?ref=badge) npx agentictools info skills/trailofbits-skills-codeql The second line is the CLI lookup for this page — handy in READMEs and docs.
