dotnet-codeql

Integrate CodeQL security analysis into .NET repositories via CLI or GitHub Actions.

466|35|Updated Mar 15, 2026

Search Tags:#static analysis #security #github actions #.net #vulnerability scanning #codeql

Ready to run

npx skills add https://github.com/managedcode/dotnet-skills --skill dotnet-codeql

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dotnet-codeql
Source: https://github.com/managedcode/dotnet-skills/tree/main/skills/dotnet-codeql
Command: npx skills add https://github.com/managedcode/dotnet-skills --skill dotnet-codeql

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the challenge of ensuring .NET codebases are secure by integrating the powerful CodeQL static analysis tool, preventing vulnerabilities before they reach production.

Core Features & Use Cases

Security Analysis: Leverages CodeQL's extensive query packs to identify common and complex security flaws in .NET code.
CI/CD Integration: Facilitates setup of CodeQL scanning within GitHub Actions workflows for automated security checks on every commit or pull request.
Use Case: A development team wants to proactively identify potential SQL injection or cross-site scripting vulnerabilities in their ASP.NET Core application before deploying to production.

Quick Start

Set up CodeQL for this public .NET repository to scan for security vulnerabilities.

Frequently Asked Questions about dotnet-codeql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up CodeQL scanning for a .NET repository to find security vulnerabilities?▼

To set up CodeQL scanning for a .NET repository, you can configure a GitHub Actions workflow or use the CodeQL CLI. This applies CodeQL query packs to analyze your codebase and identify potential vulnerabilities.

Can I use CodeQL for static analysis on private .NET repositories?▼

You can use CodeQL for static analysis on private .NET repositories, but explicit licensing caveats apply. Setting up the GitHub Action requires acknowledging these licensing requirements for private codebases.

What security vulnerabilities can CodeQL identify in ASP.NET Core applications?▼

CodeQL static analysis can identify common and complex security flaws in ASP.NET Core applications, such as potential SQL injection or cross-site scripting vulnerabilities, preventing them from reaching production.

Does CodeQL vulnerability scanning integrate with GitHub Actions CI/CD pipelines?▼

Yes, CodeQL vulnerability scanning integrates with GitHub Actions CI/CD pipelines. This facilitates automated security checks on every commit or pull request within your .NET development workflow.

What do I need to run CodeQL CLI analysis on an open-source .NET codebase?▼

Running CodeQL CLI analysis on an open-source .NET codebase requires a GitHub-based or CLI-based CodeQL workflow. The process applies CodeQL query packs to perform static analysis and detect security flaws.