codeql

89 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By trailofbits/skills (GitHub) · coding · 8,130 stars · scanned at commit e4dd0bb

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension…

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 16 places.

plugins/static-analysis/skills/codeql/SKILL.md, line 63USER_SPECIFIED_DIR="${USER_SPECIFIED_DIR:-}" # substitute the user's path here, if any
plugins/static-analysis/skills/codeql/SKILL.md, line 107if ! DB_LIST=$("{baseDir}/scripts/find_databases.sh" "${OUTPUT_DIR:-.}" .); then
plugins/static-analysis/skills/codeql/SKILL.md, line 141if ! command -v codeql >/dev/null 2>&1; then

Show 13 more

plugins/static-analysis/skills/codeql/scripts/test_build_log.py, line 16def _bash(script: str, cwd: Path) -> subprocess.CompletedProcess[str]:
plugins/static-analysis/skills/codeql/scripts/test_build_log.py, line 17return subprocess.run(
plugins/static-analysis/skills/codeql/scripts/test_build_log.py, line 67result = subprocess.run(
plugins/static-analysis/skills/codeql/scripts/test_build_log.py, line 84result = subprocess.run(
plugins/static-analysis/skills/codeql/scripts/test_find_databases.py, line 46def _invoke(tmp_path: Path, *roots: str) -> subprocess.CompletedProcess[str]:
plugins/static-analysis/skills/codeql/scripts/test_find_databases.py, line 48return subprocess.run(
plugins/static-analysis/skills/codeql/scripts/test_generation_scripts.py, line 179) -> subprocess.CompletedProcess[str]:
plugins/static-analysis/skills/codeql/scripts/test_generation_scripts.py, line 192return subprocess.run(
plugins/static-analysis/skills/codeql/scripts/test_script_flags.py, line 49result = subprocess.run(
plugins/static-analysis/skills/codeql/scripts/test_shell_blocks.py, line 112result = subprocess.run(["bash", "-n"], input=cleaned, capture_output=True, text=True)
plugins/static-analysis/skills/codeql/scripts/test_verify_query_suite.py, line 12def _result(stdout: str, returncode: int = 0, stderr: str = "") -> subprocess.CompletedProcess[str]:
plugins/static-analysis/skills/codeql/scripts/test_verify_query_suite.py, line 13return subprocess.CompletedProcess([], returncode, stdout, stderr)
plugins/static-analysis/skills/codeql/scripts/verify_query_suite.py, line 31result = subprocess.run(command, capture_output=True, text=True)

Downloads and installs other software

This is disclosed by the author in the skill's SKILL.md or README.

Found in 9 places.

plugins/static-analysis/skills/codeql/SKILL.md, line 144echo " brew install --cask codeql" >&2
plugins/static-analysis/skills/codeql/SKILL.md, line 152echo "ERROR: jq not found on PATH (brew install jq / apt install jq)" >&2
plugins/static-analysis/skills/codeql/references/build-fixes.md, line 46run_logged pip install -r requirements.txt || FAILED_INSTALLS+=("pip install -r requirements.txt")

Show 6 more

plugins/static-analysis/skills/codeql/references/build-fixes.md, line 49run_logged pip install -e . || FAILED_INSTALLS+=("pip install -e .")
plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md, line 169description: "Run: brew install llvm make — then retry with Homebrew toolchain"
plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md, line 183run_logged brew install llvm make || {
plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md, line 184log_result "FAILED: brew install did not complete — do not retry 2m-a, it will fail identically"
plugins/static-analysis/skills/codeql/references/quality-assessment.md, line 167if pip install "$stub" 2>/dev/null; then
plugins/static-analysis/skills/codeql/references/quality-assessment.md, line 175run_logged pip install -e . || log_result "WARNING: pip install -e . failed — extraction may stay incomplete"

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'codeql' ] || [ -L ~/.agents/skills/'codeql' ]; then echo 'A skill folder named codeql already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/trailofbits/skills' "$d" && git -C "$d" checkout --quiet 'e4dd0bb5b15535f7c5a0834187dffba6ac37e4ff' -- 'plugins/static-analysis/skills/codeql' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/static-analysis/skills/codeql' ~/.agents/skills/'codeql' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'codeql' ~/.claude/skills/'codeql' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for trailofbits/skills shows the score of its lowest-scoring skill.

SkillTrust badge for trailofbits/skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/trailofbits/skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/trailofbits/skills/)

Score history

Date	Version	Score
2026-11-08	`e4dd0bb`	89
2026-11-07	`e4dd0bb`	89