codeql-semgrep

What problem does it solve?

It solves the problem of missing security vulnerabilities in code by combining deep data-flow analysis with structural pattern matching, producing actionable remediation guidance that can be enforced in CI/CD.

Core Features & Use Cases

• Deep vulnerability detection with CodeQL: Traces data flow from sources (e.g., user input) to sinks (e.g., dangerous operations) to catch issues regex-based scanners often miss.
• Structural and rule-based security coverage with Semgrep: Identifies syntactic and architectural anti-patterns via custom semgrep rules, including invariants like “auth on every route” or “no stack trace leakage.”
• Project-specific security enforcement: Lets the agent generate custom CodeQL queries and Semgrep rules tailored to your codebase patterns and security requirements, then run scans as CI/CD gates.

Use case example: An AI-assisted developer submits a PR that introduces potential SQL injection and a route missing authentication; this skill generates/uses CodeQL data-flow analysis plus Semgrep custom rules to identify both issues, deduplicate findings, prioritize them, and fail the CI gate on ERROR findings.

Quick Start

Use the codeql-semgrep skill to run static security analysis on your repository and produce a prioritized remediation report from CodeQL queries and Semgrep rules.