skills.rest
JonathanMitchell1234
JonathanMitchell1234COMMUNITY
Explore all skills by this author →
GitHub

codeql-expert

Guide CodeQL query development for static analysis and vulnerability detection.

Updated Feb 27, 2026
Search Tags:#static analysis#security#sast#vulnerability detection#codeql#github security
One-click install
npx skills add https://github.com/JonathanMitchell1234/Stock-Swing-Trading-Bot --skill codeql-expert-jonathanmitchell1234
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql-expert
Source: https://github.com/JonathanMitchell1234/Stock-Swing-Trading-Bot/tree/main/.agents/skills/codeql-expert
Command: npx skills add https://github.com/JonathanMitchell1234/Stock-Swing-Trading-Bot --skill codeql-expert-jonathanmitchell1234

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides expert-level guidance for leveraging CodeQL to perform static analysis, detect vulnerabilities, and enhance the security posture of codebases.

Core Features & Use Cases

  • CodeQL Query Development: Learn to write custom QL queries for specific security or quality checks.
  • Vulnerability Detection: Identify common and complex security flaws like SQL injection, XSS, and hardcoded secrets.
  • CI/CD Integration: Integrate CodeQL analysis seamlessly into your development pipelines for continuous security scanning.
  • Use Case: A security engineer needs to find all instances of hardcoded API keys in a large JavaScript codebase. This Skill can guide them in writing and running a CodeQL query to achieve this.

Quick Start

Use the codeql-expert skill to find SQL injection vulnerabilities in a JavaScript project.

Frequently Asked Questions about codeql-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a custom CodeQL query to detect hardcoded secrets in JavaScript?▼

To write a custom CodeQL query for hardcoded secrets in JavaScript, you define semantic code analysis patterns using the QL language to identify and flag specific data flow vulnerabilities. This Skill guides custom query development.

Can I integrate CodeQL static analysis into my CI/CD pipeline for continuous security scanning?▼

Yes, you can integrate CodeQL static analysis into CI/CD pipelines for continuous security scanning. This Skill provides expert-level guidance on configuring workflows to automate vulnerability detection during software development.

Does CodeQL support static analysis for languages like Go, Python, and Java?▼

CodeQL supports static analysis for languages including C/C++, C#, Go, Java, JavaScript, TypeScript, Python, and Ruby. It addresses security and code quality concerns through semantic code analysis across these supported environments.

What is the best way to find SQL injection vulnerabilities using CodeQL?▼

The best way to find SQL injection vulnerabilities using CodeQL is to leverage its semantic code analysis to track untrusted user input flowing into database execution sinks. This Skill helps identify complex security flaws.

How do I use CodeQL to detect XSS and other complex security flaws?▼

You use CodeQL to detect XSS by writing custom QL queries that trace tainted data from user inputs to HTML output sinks. This Skill provides expert guidance for vulnerability detection and enhancing codebase security.

Related Skills

Explore More Software Engineering Skills→
PostalocityPostalocity
1

code-analyzer

Analyze codebases to extract metrics and detect design patterns.

Official
Advanced
jpoleyjpoley
50

Security Triage Skill

Classify security findings from Semgrep, CodeQL, and SARIF outputs.

Community
Advanced
softmgsoftmg

Pair Programming

Coordinate role-based pair programming sessions with automated testing and verification.

Official
Advanced
PriyanshKuniyalPriyanshKuniyal

sast-configuration

Configures and manages SAST tools for automated vulnerability detection in CI/CD pipelines.

Community
Advanced