codeql

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

70%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized with strong workflow gating and validation, but it is somewhat verbose and — most importantly — relies on a workflows/ directory whose three files are absent from the bundle, breaking the skill's primary navigation.

Suggestions

Add the missing workflows/ directory with build-database.md, create-data-extensions.md, and run-analysis.md, or correct the links to point to files that exist, since the entire Workflow Selection and 'Building unattended' sections route through them.

Tighten the repeated 'fresh shell' explanations: state the rule once and let per-site comments cite only the specific failure, trimming duplicated prose.

Surface at least one representative executable snippet for the build and analysis steps inline (or a one-line invocation) so a reader can act without first opening the missing workflow files.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and avoids explaining basic concepts, but the 'each Bash call is a fresh shell' rationale and several verbose failure-mode justifications repeat across sections and could be tightened without losing the non-obvious insight.	3 / 5
Actionability	Provides concrete executable bash blocks (output-dir resolution, discovery, dependency checks) and specific script paths, but the core build/extensions/analysis steps are delegated to workflow files rather than shown inline, leaving minor gaps.	4 / 5
Workflow Clarity	Clear gated sequence (build → extensions → analysis), explicit validation checkpoints (check_db_quality.py, verify_query_suite.py), a 'Rationalizations to Reject' recovery list, and a Success Criteria checklist — feedback loops and checklists for a batch/destructive operation are all present.	5 / 5
Progressive Disclosure	Structure is well-signaled with a one-level-deep Reference Index, but the three core workflow files referenced throughout the body (workflows/build-database.md, create-data-extensions.md, run-analysis.md) do not exist in the bundle, so the central navigation is broken.	3 / 5
	Total	15 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete capabilities, comprehensive natural trigger terms, explicit what-and-when guidance, and clear boundaries against sibling skills. No gaps to address.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions ('Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis', 'creates data extension models for project-specific sources and sinks') plus scan modes, giving comprehensive coverage of capabilities.	5 / 5
Completeness	Explicitly answers both what it does (scan for vulnerabilities via CodeQL dataflow/taint, create data extensions) and when to use it ('Triggers on...'), with concrete trigger phrases.	5 / 5
Trigger Term Quality	Lists comprehensive natural triggers users would say — 'run codeql', 'codeql scan', 'build codeql database', 'SAST scan', 'taint analysis', 'dataflow analysis', 'find vulnerabilities in this repo' — with synonyms and phrasings.	5 / 5
Distinctiveness Conflict Risk	Establishes a clear niche and explicitly distinguishes from sibling skills ('use the semgrep skill... use the sarif-parsing skill'), minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 4 missing	Warning

	Total	15 / 16 Passed

Repository: trailofbits/skills
Path: plugins/static-analysis/skills/codeql/SKILL.md
Commit: d3323ce

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.