skills.rest
jakubciszak
jakubciszakCOMMUNITY
Explore all skills by this author →
GitHub

codeql

Identify security vulnerabilities in codebases using CodeQL static analysis.

1|Updated Dec 10, 2025
Search Tags:#security#queries#static-analysis#ci-cd#codeql#data-flow#taint-tracking
One-click install
npx skills add https://github.com/jakubciszak/family-plan --skill codeql-jakubciszak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/jakubciszak/family-plan/tree/main/.claude/skills/external/static-analysis/skills/codeql
Command: npx skills add https://github.com/jakubciszak/family-plan --skill codeql-jakubciszak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CodeQL-based static analysis helps identify security vulnerabilities, taint paths, and complex data flows across codebases, enabling proactive remediation.

Core Features & Use Cases

  • Static analysis with CodeQL: Detects vulnerabilities using Language-agnostic queries and interprocedural data flow tracking.
  • Database and query authoring: Create CodeQL databases and write custom QL queries for domain-specific audits.
  • CI/CD integration: Integrate CodeQL scans into CI pipelines for automated security checks.

Quick Start

Initialize a CodeQL database for your project and run a set of security queries to surface vulnerabilities.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to find security vulnerabilities in my codebase?▼

Run static analysis by creating a CodeQL database for your buildable project, then executing security queries to surface vulnerabilities and complex data flows for remediation.

Can I write custom queries for domain-specific security audits?▼

Yes, you can write custom QL queries for domain-specific security audits. This allows you to define tailored checks for taint tracking and interprocedural data flow across your codebase.

How do I integrate CodeQL scans into a CI/CD pipeline?▼

Integrate CodeQL scans into CI/CD pipelines to automate security checks. This requires the CodeQL CLI, language-specific build steps, and repository access to generate accurate databases during automation.

Do I need the CodeQL CLI installed to perform taint tracking analysis?▼

Yes, you need the CodeQL CLI installed to perform taint tracking analysis. It is required to initialize the database and run the queries that map data flows and identify vulnerabilities.

What is CodeQL static analysis used for?▼

CodeQL static analysis is used to identify security vulnerabilities, taint paths, and complex data flows across codebases. It enables proactive remediation by tracking interprocedural data flow using language-agnostic queries.

What are the limitations of CodeQL for static code analysis?▼

CodeQL is limited to projects with buildable languages and requires language-specific build steps. You must have access to repository sources to generate accurate databases, restricting its use in unbuildable environments.

Related Skills

Explore More Software Engineering Skills→
soham2008xyzsoham2008xyz

codeql

Configure CodeQL GitHub Actions workflows and run the CLI to generate and upload SARIF results.

Community
Advanced
burgebjburgebj

octopus-security-audit

Detect software security vulnerabilities through automated security review and adversarial testing workflows.

Community
Advanced
Avi977Avi977

sarif-parsing

Parse and deduplicate SARIF files from static analysis tools for CI/CD reporting.

Community
Advanced
allanninalallanninal
1

codeql

Analyze code with CodeQL to detect security vulnerabilities and track data flow.

Community
Advanced