codeql
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.
75
92%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Quality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is an excellent skill description that clearly specifies what the skill does (CodeQL security scanning with specific analysis techniques), when to use it (explicit trigger phrases), and how it operates (two scan modes). It uses third-person voice throughout and provides enough technical detail to be distinctive without being overly verbose.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: scanning for security vulnerabilities, interprocedural data flow and taint tracking analysis, building CodeQL databases, creating data extension models, processing SARIF output, and two distinct scan modes ('run all' vs 'important only'). | 3 / 3 |
Completeness | Clearly answers both 'what' (scans codebase for security vulnerabilities using CodeQL, creates data extension models, processes SARIF output) and 'when' (explicit trigger phrases listed with 'Triggers on...' clause, plus scan mode options). | 3 / 3 |
Trigger Term Quality | Includes highly specific natural trigger phrases users would say: 'run codeql', 'codeql scan', 'codeql analysis', 'build codeql database', 'find vulnerabilities with codeql'. These are realistic user commands and cover common variations. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive — focuses specifically on CodeQL, a named tool with unique terminology (SARIF, data extension models, taint tracking). Very unlikely to conflict with generic security scanning or code analysis skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
85%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a high-quality, well-structured skill that provides excellent actionability through concrete commands and clear workflow orchestration with explicit decision trees and validation checkpoints. The progressive disclosure is exemplary with a clean reference index. The main weakness is moderate verbosity — the 'Rationalizations to Reject' section and some explanatory content could be condensed without losing clarity.
Suggestions
Condense the 'Rationalizations to Reject' section — several items repeat Essential Principles (e.g., database quality, zero findings, build-mode=none). Consider merging into a compact 'Common Mistakes' bullet list.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is mostly efficient but includes some sections that could be tightened — the 'Rationalizations to Reject' section is lengthy and somewhat redundant with the Essential Principles, and the 'When to Use / When NOT to Use' sections explain things Claude likely already knows. However, most content earns its place with specific commands and concrete guidance. | 2 / 3 |
Actionability | The skill provides fully executable bash commands for database discovery, output directory resolution, CodeQL verification, and database metadata extraction. The workflow selection logic includes concrete conditional tables and specific AskUserQuestion templates with exact formatting. | 3 / 3 |
Workflow Clarity | The skill has excellent workflow sequencing with clear decision trees (auto-detection logic table), explicit validation checkpoints (database quality assessment, zero-finding investigation), and a comprehensive success criteria checklist. The principle 'Follow workflows step by step' with gating between phases demonstrates strong feedback loop awareness. | 3 / 3 |
Progressive Disclosure | The skill provides a clear overview with well-organized sections and a comprehensive Reference Index table pointing to 15+ one-level-deep reference files and workflows. Content is appropriately split between the main SKILL.md (principles, output structure, workflow selection) and detailed workflow/reference files. | 3 / 3 |
Total | 11 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- trailofbits/skills
- Commit
a56045e
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.