skills.rest
marduk191
marduk191COMMUNITY
Explore all skills by this author →
WebsiteGitHub

codeql

Analyze codebases with CodeQL to uncover security vulnerabilities and dataflow issues.

9|4|Updated Feb 7, 2026
Search Tags:#security#queries#static-analysis#ci-cd#codeql#dataflow#taint-tracking
One-click install
npx skills add https://github.com/marduk191/qwen3_mcp --skill codeql-marduk191
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/marduk191/qwen3_mcp/tree/main/skills/static-analysis/skills/codeql
Command: npx skills add https://github.com/marduk191/qwen3_mcp --skill codeql-marduk191

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CodeQL static analysis helps identify security vulnerabilities, dataflow taint, and complex code-quality issues across codebases.

Core Features & Use Cases

  • Create CodeQL databases for languages supported by CodeQL and run both built-in and custom queries.
  • Integrate with CI/CD pipelines to automate security checks and policy enforcement.
  • Use for security audits, code reviews, and infrastructure as code security analyses.

Quick Start

Install CodeQL and run a basic security query against your codebase.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I use CodeQL to find security vulnerabilities in my codebase?▼

CodeQL static analysis identifies security vulnerabilities by creating a CodeQL database for your codebase and running built-in or custom queries to uncover dataflow taint and complex code-quality issues.

Can I integrate CodeQL static analysis into a CI/CD pipeline?▼

Yes, CodeQL integrates with CI/CD pipelines to automate security checks and enforce security policies, running taint tracking and interprocedural analysis during your build process.

How does taint tracking work for finding dataflow issues in compiled and interpreted languages?▼

Taint tracking uses interprocedural analysis to trace how untrusted data flows through compiled and interpreted languages, uncovering security gaps by mapping data paths from sources to sinks using CodeQL queries.

What is the best way to write custom queries for CodeQL databases?▼

Writing custom CodeQL queries involves querying your created CodeQL databases to perform targeted interprocedural analysis, allowing you to define specific dataflow conditions to detect unique security vulnerabilities.

Does CodeQL support security audits and infrastructure as code analysis for enterprise repos?▼

Yes, CodeQL supports security audits, code reviews, and infrastructure as code security analyses across open-source projects and enterprise repos by running targeted static analysis queries.

What do I need to install to run a basic CodeQL security query using CLI workflows?▼

You need to install the CodeQL CLI tool, which provides step-by-step workflows for creating databases, running security queries, and writing custom queries against your local codebase.

Related Skills

Explore More Software Engineering Skills→
Cogni-AI-OUCogni-AI-OU
3

codeql

Configure CodeQL workflows and CLI runs to generate and upload SARIF findings.

Official
Intermediate
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
duanbiao2000duanbiao2000
3

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Community
Advanced
zcacereszcaceres
7

investigate-repo

Audit third-party GitHub repositories for supply-chain risks via static analysis.

Community
Advanced