Code Review & Testing · IN-DEPTH PROFILE

codeql

Interprocedural security analysis with explicit database-quality and query-suite gates.

View listed source ↗Installation guide ↓
Best for

Application-security engineers scanning substantial repositories

What you get

Build a trustworthy database + Model project data flow

Main limitation

Requires CodeQL, jq, uv, a buildable target, and potentially long database construction.

First risk

Build and scan side effects. Database creation executes project build commands and may download query packs. Use an isolated checkout, review build scripts, and keep credentials out of the scan environment.

EVIDENCE FRESHNESS

Three checks, kept separate

A recent source check is not a runtime test or security audit.

Upstream sourceChecked 2026-08-20

Pinned revision · 9b281335

Open pinned commit ↗
SkillSignal profileEditorial metadata

Updated 2026-08-20

Runtime & securityNot independently verified

Source review does not certify behavior or safety.

30-SECOND BRIEF

What it does—and when it fits

CodeQL is Trail of Bits' interprocedural security-analysis workflow for eight language families. It treats database extraction quality, project-specific data-flow models, explicit query suites, and zero-result investigation as required gates rather than optional cleanup.

INSTALL BY AGENT

Choose your Agent

Paths come from official Agent docs or the universal installer behind skills.sh. Compatibility still follows this Skill's record.

Native

This Skill's current record explicitly names this Agent. Still inspect scripts, permissions, and external dependencies first.

Project scope.claude/skills/codeql/
Personal scope~/.claude/skills/codeql/

Use project scope for team sharing and personal scope across repositories. The installer defaults to project scope; add -g for personal scope.

Install command (project scope)npx skills add trailofbits/skills --skill codeql --agent claude-code
Official agent docs

Claude Code discovers custom Skill folders automatically at project or personal scope.

View path evidence ↗

TYPICAL WORKFLOW

A practical workflow

01

Build a trustworthy database

Try supported build strategies and reject databases that extracted too little code.

02

Model project data flow

Add custom sources, sinks, and summaries for framework wrappers.

03

Run explicit suites

Preserve raw SARIF and verify the selected query set is non-empty.

THE TRADEOFFS

Advantages and tradeoffs

Notable strengths

  1. Quality gates reduce false clean results caused by empty extraction or silently filtered queries.
  2. Supports deep data-flow analysis across major compiled and interpreted languages.

Limitations

  1. Requires CodeQL, jq, uv, a buildable target, and potentially long database construction.
  2. Static analysis findings still require manual exploitability review and can miss runtime-only behavior.

BEST FIT

Who it is for

→

Application-security engineers scanning substantial repositories

→

Teams that need reproducible SARIF evidence rather than a quick pattern scan

BEFORE YOU USE IT

Risks to review before use

High

Build and scan side effects

Database creation executes project build commands and may download query packs. Use an isolated checkout, review build scripts, and keep credentials out of the scan environment.

SECURITY

What the permission profile means

  • Run untrusted builds in a disposable sandbox with no production credentials.
  • Treat zero findings as inconclusive until extraction and suite checks pass.

Not a security certification. External ratings are attributed references. SkillSignal has not independently executed or security-reviewed this Skill.

INSIDE THE PACKAGE

Indexed files

SKILL.mdUpstream package contentSource-linked
workflows/Upstream package contentSource-linked
references/Upstream package contentSource-linked
scripts/Upstream package contentSource-linked

TAGS

codeqlsastdata-flow

Original SkillSignal editorial profile grounded in Trail of Bits commit 9b281335, checked 2026-08-20; not independently executed or security-certified.