skills.rest
aleister1102
aleister1102COMMUNITY
Explore all skills by this author →
GitHub

codeql

Create CodeQL databases, run custom queries, and analyze SARIF results.

Updated Aug 23, 2026
Search Tags:#security#queries#static-analysis#ci-cd#codeql#dataflow#taint-tracking
One-click install
npx skills add https://github.com/aleister1102/skills --skill codeql-aleister1102
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/aleister1102/skills/tree/main/codeql
Command: npx skills add https://github.com/aleister1102/skills --skill codeql-aleister1102

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CodeQL enables automated security analysis across codebases by detecting vulnerabilities, taint tracking, and data-flow analysis to identify risky data paths.

Core Features & Use Cases

  • Create CodeQL databases for supported languages to prepare code for analysis.
  • Write and run custom QL queries to audit code for security issues and policy violations.
  • Integrate with CI/CD pipelines to enforce continuous security checks in software delivery.
  • Perform interprocedural data-flow analysis to trace taint from sources to sinks across function boundaries.

Quick Start

Initialize a CodeQL database for your project and run the default security queries to start the analysis.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform static analysis to trace dataflow and taint tracking in my codebase?▼

Static analysis using dataflow and taint tracking is performed by creating a CodeQL database for your supported language, then running custom queries to trace risky data paths from sources to sinks across function boundaries.

What is the best way to integrate automated security queries into a CI/CD pipeline?▼

The best way to integrate security queries into CI/CD pipelines is by running CodeQL's automated security checks during software delivery, enforcing continuous vulnerability detection and remediating issues before deployment.

How do I write custom QL queries to audit code for specific security vulnerabilities?▼

You write custom QL queries to audit code for security vulnerabilities by leveraging CodeQL's dataflow analysis and taint-tracking capabilities to identify policy violations and risky data paths within your project.

Can I use CodeQL for static analysis on any programming language?▼

CodeQL static analysis is applicable to projects with source code access across languages supported by CodeQL, enabling database creation and query execution for comprehensive security audits within those specific languages.

How do I interpret SARIF results generated from CodeQL security audits?▼

SARIF results generated from CodeQL security audits are interpreted within automated security workflows, allowing you to review identified vulnerabilities, dataflow paths, and policy violations detected by your executed queries.

Related Skills

Explore More Software Engineering Skills→
rauly-1408rauly-1408

codeql

Detect security vulnerabilities in source code using CodeQL data flow analysis.

Community
Advanced
glogaiglogai

glog-plan

Generate a SARIF report and remediation plan from a glog-action security scan.

Official
Advanced
act70255act70255

deployment-pipeline-design

Design multi-stage CI/CD pipelines with approval gates and security checks.

Community
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate