skills.rest
roderik
roderikCOMMUNITY
Explore all skills by this author →
Website𝕏@roderikGitHub

codeql

Identify security vulnerabilities in source code using CodeQL static analysis.

2|Updated Jan 21, 2026
Search Tags:#security#static-analysis#ci-cd#codeql#data-flow#query-development#taint-tracking
One-click install
npx skills add https://github.com/roderik/mpe --skill codeql
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/roderik/mpe/tree/main/.agents/skills/codeql
Command: npx skills add https://github.com/roderik/mpe --skill codeql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill enables secure code analysis by applying CodeQL to identify vulnerabilities, track taint, and analyze data flow across projects.

Core Features & Use Cases

  • Static analysis for security: Detect vulnerabilities using CodeQL queries across languages and CI pipelines.
  • Interprocedural data flow: Trace tainted data across function boundaries to priorities findings.
  • Custom query development: Create and run bespoke CodeQL queries to cover domain-specific security checks.
  • Use Case: Integrate CodeQL into a CI workflow to fail builds when critical vulnerabilities are detected.

Quick Start

Install the CodeQL CLI, create a database for your project, and run a security analysis to generate SARIF results.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I use static analysis to identify security vulnerabilities in source code?▼

Static analysis identifies security vulnerabilities in source code by applying CodeQL queries to trace interprocedural data flow and taint across function boundaries, generating SARIF or CSV outputs. It requires the CodeQL CLI to create databases and run analyses.

How do I integrate CodeQL into a CI pipeline to fail builds on critical vulnerabilities?▼

You integrate CodeQL into a CI pipeline by creating a database for your project and running security analyses during the build process to generate SARIF results, configuring the workflow to fail when critical vulnerabilities are detected.

Can I track interprocedural data flow and taint across different languages with CodeQL?▼

Yes, you can track interprocedural data flow and taint across different languages using CodeQL static analysis. It supports tracing tainted data across function boundaries to prioritize security findings within your projects.

What do I need to develop and run custom CodeQL queries for domain-specific security checks?▼

To develop and run custom CodeQL queries for domain-specific security checks, you need the CodeQL CLI tooling installed to create project databases, alongside optional Trail of Bits queries, to execute bespoke analyses and produce results.

What output formats are generated when running CodeQL data flow tracking and taint analysis?▼

Running CodeQL data flow tracking and taint analysis generates SARIF or CSV output formats, standardizing the static analysis results to help identify and prioritize security vulnerabilities detected within your source code.

Related Skills

Explore More Software Engineering Skills→
elizaOSelizaOS
19.0k

codeql

Perform static security analysis with CodeQL queries and data flow tracking.

Official
Advanced
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
jpoleyjpoley
50

Security Triage Skill

Classify security findings from Semgrep, CodeQL, and SARIF outputs.

Community
Advanced
vertivolatamvertivolatam
1

Static Analysis

Run static analysis across multiple programming languages with linters and security scanners.

Official
Advanced