static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Updated Apr 6, 2026

Search Tags:#static-analysis #codeql #semgrep #security-analysis #sarif #taint-tracking

Ready to run

npx skills add https://github.com/dakshrawat298-gif/SOL-ALPHA-GUARDIAN --skill static-analysis-dakshrawat298-gif

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: static-analysis
Source: https://github.com/dakshrawat298-gif/SOL-ALPHA-GUARDIAN/tree/main/packages/skills/skills/static-analysis
Command: npx skills add https://github.com/dakshrawat298-gif/SOL-ALPHA-GUARDIAN --skill static-analysis-dakshrawat298-gif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing to detect security vulnerabilities, data-flow gaps, and quality issues across codebases.

Core Features & Use Cases

Deep security analysis with CodeQL for interprocedural taint tracking and data-flow analysis.
Fast pattern-based scanning with Semgrep and CI/CD integration.
SARIF parsing to aggregate, deduplicate, and triage findings from multiple scanners.

Quick Start

Run a quick static-analysis scan on your codebase to detect vulnerabilities, taint paths, and SARIF results.

Frequently Asked Questions about static-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I parse and unify SARIF results from multiple static analysis tools?▼

To parse and unify SARIF results, you need a scanner that can aggregate, deduplicate, and triage findings from multiple tools into a single output. This process supports outputs in SARIF, JSON, or CSV for multi-language repositories.

How does taint tracking work for detecting security vulnerabilities in a codebase?▼

Taint tracking detects security vulnerabilities by analyzing data-flow paths from untrusted sources to sensitive sinks. Tools like CodeQL perform interprocedural taint tracking to identify deep data-flow gaps and security issues across multi-language repositories.

Can I run Semgrep scans and CodeQL analysis within the same CI pipeline?▼

Yes, you can integrate both Semgrep for fast pattern-based scanning and CodeQL for deep security analysis within the same CI pipeline. Aggregating their outputs allows you to unify static analysis results for comprehensive vulnerability triage.

What is the best way to triage static analysis findings across a multi-language codebase?▼

The best way to triage static analysis findings across a multi-language codebase is to parse outputs from CodeQL and Semgrep scans into a unified format. SARIF parsing enables you to aggregate, deduplicate, and triage vulnerabilities effectively.

Does static analysis with CodeQL support multi-language repositories?▼

Static analysis with CodeQL supports multi-language repositories by utilizing CodeQL databases to perform interprocedural taint tracking and data-flow analysis. This allows you to detect security vulnerabilities and quality issues across diverse codebases.

What are the limitations of using Semgrep compared to CodeQL for security analysis?▼

Semgrep focuses on fast pattern-based scanning, while CodeQL provides deep interprocedural taint tracking and data-flow analysis. Semgrep may miss complex vulnerabilities that CodeQL detects, but it offers faster CI/CD integration for immediate security scanning.