CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/codeql-queries

Configures and runs GitHub CodeQL - semantic-database SAST with queries written in the CodeQL declarative query language; supports `codeql database create` (per-language) + `codeql database analyze` with --format=sarif; ships query packs (`codeql/javascript-queries`, `codeql/python-queries`, `codeql/java-queries`, `codeql/go-queries`, etc.); integrates with GitHub Code Scanning via SARIF upload; suppression via inline comment + sarif-filter + Security-tab dismissal. Use when the team uses GitHub-hosted repos and needs deep semantic SAST beyond pattern matching (cross-file taint flows, dataflow analysis).

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands at every step and well-structured progressive disclosure into a real reference file. It could tighten a few redundant explanations and make post-database validation an explicit checkpoint.

Suggestions

Remove the 'database-then-query model catches cross-file taint flows' sentence from the body since that rationale already appears in the description, saving tokens.

Add an explicit validation checkpoint after Step 2 (e.g., 'verify the database is non-empty: `codeql database info my-db`') before running analysis, since the anti-pattern notes that empty databases fail silently.

Tighten the Step 1 prose ('Per cql-docs the CLI is bundled separately from the queries - install both') which restates information already implied by the install commands.

DimensionReasoningScore

Conciseness

Dense and assumes Claude's competence (no preamble on what SAST/SARIF are), with only minor over-explanation such as re-deriving the cross-file taint rationale already in the description that could be trimmed.

4 / 5

Actionability

Copy-paste-ready bash throughout — database create, analyze with --format=sarif-latest, a jq SARIF filter, a concrete inline suppression template, and GitHub Actions YAML in the reference — covering the common cases.

5 / 5

Workflow Clarity

A clear five-step sequence with a MANDATORY triage step and an anti-patterns section flagging silent empty-database failures, but validation checkpoints (e.g., verify the database populated before analyze) are implicit rather than explicit validate→fix→retry loops.

4 / 5

Progressive Disclosure

The body is an overview spine that defers the pack list, query suites, custom .ql example, and CI integration to a clearly signaled, verified one-level-deep reference (references/codeql-reference.md) with no nested indirection.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and distinctive, pairing concrete CodeQL actions with an explicit 'Use when' trigger clause. It is slightly jargon-forward, which keeps trigger-term coverage just short of fully comprehensive.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — database create/analyze with --format=sarif, query packs, SARIF upload to Code Scanning, and three suppression mechanisms — giving comprehensive coverage rather than vague language.

5 / 5

Completeness

Explicitly answers what (configures/runs CodeQL, ships packs, integrates Code Scanning, suppression) and when ('Use when the team uses GitHub-hosted repos and needs deep semantic SAST beyond pattern matching') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural terms (GitHub CodeQL, SAST, GitHub-hosted repos, cross-file taint flows, SARIF, Code Scanning), but leans jargon-heavy and omits common synonyms like 'static analysis'/'security scan' and file extensions, so just below fully comprehensive.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (GitHub CodeQL semantic SAST) with specific triggers (GitHub-hosted, cross-file taint) and is explicitly distinguished from sister scanners semgrep-rules/sonarqube-rules, minimizing wrong-skill triggers.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents