CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/codeql-queries

Configures and runs GitHub CodeQL - semantic-database SAST with queries written in the CodeQL declarative query language; supports `codeql database create` (per-language) + `codeql database analyze` with --format=sarif; ships query packs (`codeql/javascript-queries`, `codeql/python-queries`, `codeql/java-queries`, `codeql/go-queries`, etc.); integrates with GitHub Code Scanning via SARIF upload; suppression via inline comment + sarif-filter + Security-tab dismissal. Use when the team uses GitHub-hosted repos and needs deep semantic SAST beyond pattern matching (cross-file taint flows, dataflow analysis).

70

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clear, validated multi-step workflow and clean progressive disclosure to a single reference file. Its main weakness is conciseness: it restates CodeQL fundamentals and carries conceptual padding that Claude already knows.

Suggestions

Cut the 'Overview' paragraph that re-explains what CodeQL is and why database-then-query matters — Claude already knows this; keep only the operational model.

Tighten the 'When to use' bullets and 'Limitations' list, which partly restate concepts rather than instruct action.

Move the long inline SARIF jq one-liner and justification template detail into the reference file to reduce body token weight.

DimensionReasoningScore

Conciseness

Mostly efficient with executable commands throughout, but it explains CodeQL basics Claude already knows ('CodeQL is GitHub's semantic-analysis SAST: build a database...') and the overview/when-to-use/limitations sections pad the body with conceptual context that could be trimmed.

2 / 3

Actionability

Fully executable commands at every step — install curl/unzip, database create with language and build commands, database analyze with --format=sarif, performance flags --threads/--ram, and a concrete FP-suppression template — copy-paste ready.

3 / 3

Workflow Clarity

Five clearly sequenced steps with a mandatory FP-triage section, explicit 'MUST wrap the build' guidance, an anti-patterns table mapping failure to fix, and a quarterly review cadence forming a validation/feedback loop.

3 / 3

Progressive Disclosure

The SKILL.md spine keeps the core create/analyze/triage path and clearly signals one-level-deep detail in references/codeql-reference.md, which holds the pack list, custom .ql example, and CI integration — well split and easy to navigate.

3 / 3

Total

11

/

12

Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific, complete with an explicit 'Use when' trigger, and well-differentiated from sibling SAST skills. It is slightly weaker on trigger-term quality because it leans on technical jargon rather than the everyday terms a user might say.

Suggestions

Add natural-language trigger terms a user would actually say (e.g. 'CodeQL', 'GitHub Code Scanning', 'static analysis', 'security scan') alongside the technical phrasing.

The description runs long with enumerated pack names and suppression mechanisms — consider trimming the pack list to one example to reduce verbosity.

DimensionReasoningScore

Specificity

Names many concrete actions — 'codeql database create (per-language) + codeql database analyze with --format=sarif', 'ships query packs', 'integrates with GitHub Code Scanning via SARIF upload', 'suppression via inline comment + sarif-filter + Security-tab dismissal'.

3 / 3

Completeness

Explicitly answers what (configures/runs CodeQL, SARIF output, packs, suppression) and when ('Use when the team uses GitHub-hosted repos and needs deep semantic SAST beyond pattern matching'), satisfying both the what and when with explicit triggers.

3 / 3

Trigger Term Quality

It uses technical trigger phrasing ('GitHub-hosted repos', 'deep semantic SAST', 'cross-file taint flows, dataflow analysis') that a security engineer might say, but omits common user variations like 'CodeQL', 'static analysis', or 'security scan' as standalone natural keywords.

2 / 3

Distinctiveness Conflict Risk

The CodeQL/SARIF/semantic-SAST niche is well-specified and explicitly scoped to GitHub-hosted repos with cross-file taint flows, clearly distinguishing it from sister scanners like semgrep or sonarqube.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents