Skip to content
← Tools / Skills
Skill · .md packageTrail of Bits/10 trustVerified

codeql

>- Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis.

Visit official site →

About

>-

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and

taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database",

"SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo".

Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports

"run all" (security-and-quality + security-experimental) and "important only"

(high-precision) scan modes, and creates data extension models for project-specific sources

and sinks. For fast single-file pattern matching, or when no build is available for a

compiled language, use the semgrep skill; to parse SARIF that already exists rather than

produce it, use the sarif-parsing skill.

allowed-tools: Bash Read Write Edit Glob Grep AskUserQuestion TaskCreate TaskList TaskUpdate TaskGet

What it can do

  • >-
  • Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and
  • taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database",
  • "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo".
  • Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports
  • "run all" (security-and-quality + security-experimental) and "important only"
  • (high-precision) scan modes, and creates data extension models for project-specific sources
  • and sinks. For fast single-file pattern matchin

Setup

  1. Install: npx skills add trailofbits/skills --all
  2. The skill auto-loads when relevant, or invoke it by name in your agent.

Prerequisites

A compatible AI coding agent (Claude Code, Cursor, etc.).

Use cases

codedesignsecuritywriting

Works with

Claude CodeAny agent (.md)

Trust score — 9/10

/10 trustVerified

Trail of Bits is a top-tier security research firm; their skills are professional-grade auditing and fuzzing playbooks used by their own engineers. Open source.

Sources

Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.