codeql

Automates CodeQL security analysis across multi-language codebases.

16|4|Updated Mar 22, 2026

Search Tags:#vulnerability #codebase #codeql #suite #security-analysis #data-extensions

Ready to run

npx skills add https://github.com/idchain-world/id-agents --skill codeql-idchain-world

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/idchain-world/id-agents/tree/main/configs/agents/security/skills/static-analysis/codeql
Command: npx skills add https://github.com/idchain-world/id-agents --skill codeql-idchain-world

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Code security analysis for codebases using CodeQL to detect vulnerabilities across languages, enabling automation and repeatable findings.

Core Features & Use Cases

Automates language-detection, CodeQL database creation, and data-extension generation to improve coverage.
Supports run-all and important-only analysis modes with logged outputs and customizable suites.
Integrates threat-model selection and remote/public API scanning for end-to-end security audits.

Quick Start

Trigger a full CodeQL security analysis across a repository by configuring the language, building the database, generating data extensions, and executing a targeted run.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate CodeQL security analysis across a multi-language codebase?▼

Automate CodeQL security analysis by coordinating language detection, database creation, data extension generation, and targeted queries across multi-language codebases to detect vulnerabilities with repeatable findings.

What is interprocedural taint tracking and when do I need custom data extensions for it?▼

Interprocedural taint tracking follows data flow across function boundaries to detect vulnerabilities. Custom data extensions improve tracking coverage by modeling external sources and sinks within the CodeQL database.

How do I configure CodeQL suites to run important-only queries instead of all queries?▼

Configure CodeQL suites by selecting important-only or run-all analysis modes. This targets specific vulnerability queries during security audits, generating logged outputs and customizable reports based on the chosen suite.

Does CodeQL analysis support threat-model selection and remote API scanning?▼

CodeQL analysis supports threat-model selection and remote API scanning to execute end-to-end security audits. This enables configurable vulnerability detection tailored to specific threat models and public API endpoints.

What steps are required to generate data extensions and validate the CodeQL database?▼

Generate data extensions and validate the CodeQL database by triggering language detection, building the database, deploying extensions, and executing queries. This process ensures accurate interprocedural taint tracking results.

Why does CodeQL database creation fail during automated multi-language codebase analysis?▼

CodeQL database creation fails when language detection is incomplete or validation errors occur. Automating database creation requires proper language configuration and extension deployment to ensure successful vulnerability analysis.