codeql

The CodeQL skill provides an advanced static analysis toolkit for security engineers and developers to perform comprehensive vulnerability research. By leveraging CodeQL’s powerful interprocedural data flow and taint tracking engines, this skill helps identify complex security flaws that simple pattern matching often misses. It automates the entire analysis lifecycle, from building language-specific CodeQL databases to running custom query suites and processing SARIF output for actionable reporting. This skill is designed for high-precision security audits where understanding data movement from untrusted sources to sensitive sinks is critical. It acts as an orchestrator for local analysis, managing database creation, data extension modeling for custom frameworks, and suite selection to ensure consistent, repeatable security assessments. It is particularly useful for auditing large codebases in Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift.

• Performs automated build and database generation for compiled and interpreted languages.

• Supports custom scan modes: 'run all' for exhaustive coverage using experimental suites and 'important only' for focused, high-precision findings.

• Manages data extension models to accurately map project-specific frameworks, request parsers, and custom wrappers.

• Integrates quality assessment gates to ensure database integrity, including file count verification and baseline lines-of-code metrics.

• Orchestrates SARIF (Static Analysis Results Interchange Format) processing for seamless integration with vulnerability management workflows.

• Utilizes custom .qls suite files to prevent silent query dropping and ensure all relevant security rules are applied.

• Target languages include Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift.

• Requires local CodeQL CLI installation; follow workspace instructions for dependency setup.

• Output is managed in structured directories, defaulting to static_analysis_codeql_N for easy traceability and auditability.

• Always perform quality checks on the generated database before relying on scan results; zero findings should be investigated for potential database extraction issues or suite misconfigurations.

• Apple Silicon (macOS) users should use provided workarounds for exit code 137, such as Homebrew arm64 tools or Rosetta-based builds.