codeql

Scan codebases for security vulnerabilities using CodeQL data flow analysis.

77|3|Updated Mar 24, 2026

Search Tags:#security #static-analysis #codeql #data-flow #sarif #taint-tracking

Ready to run

npx skills add https://github.com/FlorianBruniaux/starmapper --skill codeql-florianbruniaux

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/FlorianBruniaux/starmapper/tree/main/.claude/plugins/static-analysis/skills/codeql
Command: npx skills add https://github.com/FlorianBruniaux/starmapper --skill codeql-florianbruniaux

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Trigger phrases include "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports two scan modes: "run all" and "important only," and can create data extension models while processing SARIF output.

Core Features & Use Cases

Trigger on common phrases and run modes to streamline security scanning.
Create data extension models and process SARIF output to improve coverage and reporting.
Integrates across languages and outputs results suitable for CI dashboards.

Quick Start

Run the skill on your repository to build the CodeQL database, optionally generate data extensions, and run the analysis in your chosen mode.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my codebase for security vulnerabilities using static analysis?▼

Scanning a codebase for security vulnerabilities involves using interprocedural data flow and taint tracking analysis. You can trigger this static analysis by running specific commands to build a database and identify vulnerabilities across your code.

What is taint tracking and how does it find vulnerabilities in code?▼

Taint tracking is a static analysis technique that traces how untrusted data flows through an application's codebase. It identifies security vulnerabilities by mapping interprocedural data flow from insecure sources to dangerous sinks.

How do I process SARIF output from a code security scan?▼

Processing SARIF output from a security scan involves parsing the standardized format to extract vulnerability data. This allows you to generate data extension models and integrate the interprocedural analysis results directly into CI dashboards.

Can I run static analysis only for important security vulnerabilities?▼

Yes, you can run static analysis using an "important only" scan mode. This restricts the interprocedural taint tracking to surface only the most critical vulnerabilities, alongside an alternative "run all" mode for comprehensive coverage.

Does this static analysis tool work across multiple programming languages?▼

Yes, the static analysis integrates across multiple languages to find security vulnerabilities using interprocedural data flow. It builds a unified database to support comprehensive taint tracking and outputs results suitable for CI dashboards.