skills.rest
adamatdevops
adamatdevopsCOMMUNITY
Explore all skills by this author →
GitHub

codeql

Build CodeQL databases, run query suites, and output SARIF reports.

1|Updated Jan 7, 2026
Search Tags:#static analysis#security scanning#codeql#sarif#threat model#data extensions#query suite
One-click install
npx skills add https://github.com/adamatdevops/forge-works --skill codeql-adamatdevops
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/adamatdevops/forge-works/tree/main/.skills/trailofbits/codeql
Command: npx skills add https://github.com/adamatdevops/forge-works --skill codeql-adamatdevops

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

CodeQL scans your codebase for security vulnerabilities with deep program analysis, helping you avoid relying on shallow pattern matching and reducing missed issues caused by incomplete databases or wrong query suites.

Core Features & Use Cases

  • End-to-end CodeQL pipeline: builds a high-quality CodeQL database (with compiled-language build tracing when needed), creates data extensions, and runs analysis.
  • Quality-first database creation: assesses baseline LoC, extraction coverage, extractor errors, and ensures the database is finalized before running queries.
  • Accurate, noise-controlled suites: uses custom query suite generation for run-all vs important-only modes, and applies post-processing filters for important-only reporting.
  • macOS Apple Silicon guardrails: detects arm64e/libtrace incompatibility and applies safe build-workarounds (Homebrew toolchain or Rosetta) instead of blindly falling back.
  • Actionable reporting artifacts: writes results and intermediate diagnostics into a dedicated output directory so you can review, rerun, or troubleshoot without cleanup chaos.

Quick Start

Run a full CodeQL scan on the current repository using the highest coverage mode and store all outputs in an auto-created directory by saying: “Scan this repo end-to-end with CodeQL and produce results.”

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a static analysis scan for security vulnerabilities in my codebase?▼

Static analysis scanning builds a high-quality CodeQL database with build tracing, generates data extensions, and executes explicit query suites to output SARIF reports for identified security vulnerabilities.

Does CodeQL static analysis work with compiled languages that require build tracing?▼

Yes, CodeQL static analysis supports compiled projects by utilizing build tracing during database creation to ensure accurate extraction coverage before running security vulnerability query suites.

What is the best way to reduce false positives when running security scanning on a large repository?▼

The best way to reduce false positives in security scanning is using custom query suite generation with important-only modes and applying SARIF post-processing filters for noise-controlled reporting.

How do I generate SARIF outputs for filtered reporting during a security audit?▼

You generate SARIF outputs by executing explicit query suites against a finalized CodeQL database, then applying post-processing filters to produce actionable reporting artifacts in a dedicated output directory.

Why does CodeQL database creation fail on macOS Apple Silicon and how do I fix it?▼

CodeQL database creation encounters arm64e/libtrace incompatibility on macOS Apple Silicon, which is resolved by applying safe build-workarounds using the Homebrew toolchain or Rosetta instead of blindly falling back.

Related Skills

Explore More Software Engineering Skills→
ayehiaaayehiaa

codeql

Run CodeQL security analysis with database building, data extensions, and SARIF filtering.

Community
Advanced
SuperlendSuperlend

sarif-parsing

Parse SARIF 2.1.0 files and extract structured findings for reporting.

Official
Intermediate
zekiriabdzekiriabd
140

codeql

Identify security vulnerabilities via CodeQL database construction and interprocedural data flow analysis.

Community
Advanced
ialamehialameh
2

security-scanner

Scan code repositories for secrets, dependency vulnerabilities, and OWASP patterns.

Community
Advanced