skills.rest
dcyfr
dcyfrCOMMUNITY
Explore all skills by this author →
Website𝕏@dcyfr_GitHub

dcyfr-security

Suppress CodeQL false positives with LGTM-style syntax and verification.

Updated Aug 23, 2026
Search Tags:#security#code-review#codeql#secure-development#false-positives#suppressions#vulnerability-troubleshooting
One-click install
npx skills add https://github.com/dcyfr/dcyfr-labs --skill dcyfr-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dcyfr-security
Source: https://github.com/dcyfr/dcyfr-labs/tree/main/.opencode/skill/dcyfr-security
Command: npx skills add https://github.com/dcyfr/dcyfr-labs --skill dcyfr-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CodeQL false positives and vulnerability issues can slow down development and obscure real security problems. This Skill guides developers through suppression techniques, vulnerability troubleshooting, and verification patterns to streamline secure coding practices.

Core Features & Use Cases

  • CodeQL suppressions with LGTM-style syntax to reduce noise while maintaining justification.
  • Security vulnerability troubleshooting for issues like SSRF and CWE-918.
  • False positive patterns and verification to prevent regressive alerts.
  • Security testing patterns and documented workflows for secure code reviews.

Quick Start

Identify a CodeQL alert, apply an LGTM suppression with a justified reason, and verify that the alert is correctly suppressed.

Frequently Asked Questions about dcyfr-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I suppress CodeQL false positives in my TypeScript codebase?▼

To suppress CodeQL false positives, apply an LGTM-style suppression comment with a justified reason to the flagged code, then verify the alert is correctly suppressed to prevent regressive noise during security reviews.

What is the best way to troubleshoot SSRF and CWE-918 security vulnerabilities?▼

Troubleshooting SSRF and CWE-918 vulnerabilities involves applying documented security testing patterns and verification workflows to identify false positives and remediate genuine security issues in modern codebases.

Does CodeQL suppression work with JavaScript and TypeScript security reviews?▼

CodeQL suppression works across TypeScript and JavaScript stacks by utilizing LGTM-style syntax to reduce false positive noise while maintaining documented justification for secure development workflows.

Why do I need to justify CodeQL suppressions during secure code reviews?▼

Justifying CodeQL suppressions is required to maintain documented security testing patterns, ensuring that silenced alerts are verified false positives and do not obscure real vulnerabilities during ongoing code reviews.

When should I apply vulnerability verification patterns instead of fixing the code?▼

Apply vulnerability verification patterns when CodeQL flags potential false positives, allowing you to confirm the alert is noise, suppress it with justification, and streamline remediation of real security issues.

Related Skills

Explore More Software Engineering Skills→
JonathanMitchell1234JonathanMitchell1234

codeql-expert

Guide CodeQL query development for static analysis and vulnerability detection.

Community
Advanced
novatech2210-cmdnovatech2210-cmd

V3 Security Overhaul

Identify and remediate critical security vulnerabilities in claude-flow v3.

Community
Advanced
BagelHoleBagelHole
46

sast-scanning

Performs static security testing on source code using Semgrep, CodeQL, and SonarQube.

Community
Intermediate
dungsnowaxedungsnowaxe

ssrf-testing

Detect SSRF vulnerabilities by testing user-controlled URL inputs against internal services and cloud metadata endpoints.

Community
Advanced