skills.rest
rbkayz
rbkayzCOMMUNITY
Explore all skills by this author →
Website𝕏@rbkayzGitHub

CodeQL Analysis

Run CodeQL static analysis to detect security vulnerabilities across multiple languages.

Updated Feb 16, 2026
Search Tags:#static analysis#security#data flow#code audit#vulnerability detection#codeql
One-click install
npx skills add https://github.com/rbkayz/gitskills --skill codeql-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: CodeQL Analysis
Source: https://github.com/rbkayz/gitskills/tree/main/skills/registry/trailofbits-codeql
Command: npx skills add https://github.com/rbkayz/gitskills --skill codeql-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the detection of security vulnerabilities in codebases using CodeQL's powerful static analysis engine, including deep data flow and taint tracking.

Core Features & Use Cases

  • Vulnerability Detection: Identifies security flaws across multiple programming languages.
  • Database Building: Creates CodeQL databases from source code, supporting compiled languages.
  • Data Flow Analysis: Leverages interprocedural data flow and taint tracking for comprehensive security audits.
  • Use Case: Scan a Python web application for common vulnerabilities like SQL injection or cross-site scripting before deployment.

Quick Start

Use the CodeQL skill to perform a full scan of the current project.

Frequently Asked Questions about CodeQL Analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate vulnerability detection in my source code?▼

Automate vulnerability detection by building a CodeQL database from your source code and executing query rulesets to identify complex security flaws. This process scans your project to find vulnerabilities automatically.

What programming languages does CodeQL support for security audits?▼

CodeQL supports static analysis for Python, JavaScript, Go, Java, C/C++, C#, Ruby, and Swift. You can perform security audits across these languages to find vulnerabilities like SQL injection or cross-site scripting.

How does data flow analysis find complex security vulnerabilities?▼

Data flow analysis tracks how data moves interprocedurally through your codebase, enabling taint tracking to identify where untrusted inputs reach sensitive sinks. This reveals complex vulnerabilities that traditional scanning misses.

Can I run static analysis on compiled languages like Go and Java?▼

Yes, you can run static analysis on compiled languages like Go and Java by creating CodeQL databases from their source code. The analysis builds these databases to support deep security scans for compiled projects.

Do I need to create custom data extensions to detect project-specific vulnerabilities?▼

Creating custom data extensions allows the static analysis to recognize your project-specific APIs during taint tracking. This enhances vulnerability detection by tailoring the data flow analysis to your unique codebase.

Related Skills

Explore More Software Engineering Skills→
flavien-iaflavien-ia
34

_convert-to-turborepo

Convert a standalone Next.js project into a Turborepo monorepo.

Community
Advanced
tonone-aitonone-ai
69

relay-audit

Audit CI/CD pipelines for slowness, security issues, and reliability gaps.

Official
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
fjor1025fjor1025

codeql

Perform static code analysis with CodeQL for security vulnerabilities and data flow.

Community
Advanced