skills.rest
vigolium
vigoliumOFFICIAL
Explore all skills by this author →
Website𝕏@VigoliumGitHub

codeql

Automates CodeQL security scanning with configurable precision modes and SARIF output.

965|142|Updated Mar 8, 2026
Search Tags:#static analysis#security scanning#codeql#sarif#vulnerability triage#data extensions#data flow taint
One-click install
npx skills add https://github.com/vigolium/vigolium --skill codeql-vigolium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: codeql
Source: https://github.com/vigolium/vigolium/tree/main/platform/vigolium-audit/src/content/skills/codeql
Command: npx skills add https://github.com/vigolium/vigolium --skill codeql-vigolium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you scan a codebase for security vulnerabilities using CodeQL while avoiding common failure modes like low-quality databases, missing project-specific data models, and silent query filtering.

Core Features & Use Cases

  • End-to-end CodeQL pipeline: builds (or reuses) a CodeQL database, creates data extensions when needed, runs analysis, and processes results into a final SARIF report.
  • Quality-first safety checks: validates extraction quality (baseline LoC, file coverage, extractor errors), and treats “zero findings” as a signal to investigate database/model/suite issues.
  • Two scan modes for precision control: run-all mode for maximum coverage, and important-only mode to focus on security-relevant findings using both suite filtering and SARIF post-filtering.
  • Apple Silicon build resilience: detects macOS arm64e issues and applies targeted workarounds (Homebrew toolchain or Rosetta), with a safe fallback.

Quick Start

Run a full CodeQL scan for vulnerabilities using the CodeQL database build, data extensions, and analysis workflow, storing all artifacts in an auto-created output directory.

Frequently Asked Questions about codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a CodeQL scan with interprocedural taint tracking and avoid silent query filtering?▼

To run a CodeQL scan with interprocedural taint tracking and avoid silent query filtering, build a CodeQL database and execute analysis using explicitly generated query suites. This ensures full coverage without queries being silently dropped from the run.

Why does CodeQL report zero findings when scanning my codebase for vulnerabilities?▼

CodeQL reporting zero findings often signals low database extraction quality or missing project-specific data models. Validating baseline lines of code, file coverage, and extractor errors helps investigate and resolve these underlying database or suite configuration issues.

How do I create data extensions for CodeQL to improve static analysis accuracy?▼

Creating data extensions for CodeQL static analysis involves building project-specific data flow taint models tailored to your codebase. This allows the scanner to accurately track sources, sinks, and sanitizers during interprocedural vulnerability triage.

Does CodeQL static analysis work on macOS Apple Silicon for security scanning?▼

CodeQL static analysis works on macOS Apple Silicon by detecting arm64e build issues and applying targeted workarounds. It can utilize a Homebrew toolchain or Rosetta with a safe fallback to ensure successful database extraction and scanning.

What is the best way to triage SARIF results from a CodeQL security scan?▼

The best way to triage SARIF results from a CodeQL security scan is using important-only precision mode. This applies both query suite filtering and SARIF post-filtering to focus exclusively on security-relevant findings for easier vulnerability triage.

How do I discover a CodeQL database using a marker file during static analysis?▼

You can discover a CodeQL database during static analysis by locating a codeql-database.yml marker file. This allows the scanning pipeline to automatically reuse an existing database instead of triggering a new build extraction.

Related Skills

Explore More Software Engineering Skills→
soham2008xyzsoham2008xyz

codeql

Configure CodeQL GitHub Actions workflows and run the CLI to generate and upload SARIF results.

Community
Advanced
erenisiklarerenisiklar

sarif-parsing

Parse and analyze SARIF security findings for triage and CI/CD integration.

Community
Advanced
elizaOSelizaOS
19.0k

static-analysis

Run CodeQL and Semgrep scans and parse SARIF results.

Official
Advanced
rohanbhatia27rohanbhatia27
1

codeql

Analyze codebases for security vulnerabilities using CodeQL data flow and taint tracking.

Community
Advanced