What problem does it solve? Finding deep security vulnerabilities like SQL injection, command injection, and path traversal requires interprocedural data flow analysis that simple pattern matching cannot provide, and misconfigured CodeQL runs silently produce empty or low-quality results. ## Core Features & Use Cases - Database Building: Creates CodeQL databases for Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift, with sequential build methods and macOS Apple Silicon workarounds. - Data Extension Generation: Detects project-specific sources, sinks, and taint wrappers that CodeQL does not model, then generates YAML extension files to close coverage gaps. - Two Scan Modes: Run-all mode (security-and-quality plus security-experimental suites) and important-only mode (high-precision findings with severity filtering of SARIF output). - Use Case: Point the skill at a repository and ask for a full security scan; it builds the database, assesses extraction quality, creates data extensions for custom APIs, runs the analysis, and delivers filtered SARIF results. ## Quick Start Ask the assistant to run a CodeQL security scan on this codebase and report the high-confidence vulnerabilities.
