codeql agent skill by trailofbits
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with run-all and important-only scan modes.
At a glance
| Publisher | Trail of Bits Official |
|---|---|
| Repository | trailofbits/skills (83 listed skills) |
| Category | Security |
| License | CC-BY-SA-4.0 |
| Last commit | October 15, 2026 (repository) |
| SKILL.md | 280 lines, 2,441 words |
| Bundled files | 34 files, including references, scripts, assets or templates |
| Quality score | 92/100 · A Passes all seven graded checks |
| Security scan | Not scanned |
| README badge | Get the badges for this listing |
Before you install
Read from the skill's files at the directory's October 19, 2026 snapshot: what ships with it, what its code reads, and the terms it is published under.
- Bundled scripts: 15 script files (12 Python, 3 Shell). Your agent may run them, so read them first.
- Commands in SKILL.md: its code blocks run
brew install, which fetches or runs software from outside the skill folder. - Tool permissions requested:
Bash Read Write Edit Glob Grep AskUserQuestion TaskCreate TaskList TaskUpdate TaskGet(theallowed-toolsfield of SKILL.md). - License: CC-BY-SA-4.0, an open-source or open-content license.
Install codeql
The skills CLI works with Claude Code, Codex, Cursor and other agents; the other routes copy the folder by hand.
npx skills add https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/codeqltmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .claude/skills
cp -R "$tmp/repo/"plugins/static-analysis/skills/codeql .claude/skills/
rm -rf "$tmp"python3 ~/.codex/skills/.system/skill-installer/scripts/install-skill-from-github.py \
--repo trailofbits/skills \
--path plugins/static-analysis/skills/codeqltrailofbits/skills is third-party code. Read SKILL.md and any bundled scripts before you install it.
How the author describes it
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.
From the description field of SKILL.md. Agents read this line to decide when to load the skill.
Sections in SKILL.md
- Essential Principles
- Each Bash call is a fresh shell
- Output Directory
- Database Discovery
- Quick Start
- Rationalizations to Reject
- Workflow Selection
- Building unattended
- Auto-Detection Logic
- Database Selection Prompt
- General Decision Prompt
- Reference Index
- Success Criteria
Files in the skill folder
SKILL.mdagents/openai.yamlassets/trail-of-bits-mark.svgreferences/build-fixes.mdreferences/diagnostic-query-templates.mdreferences/extension-yaml-format.mdreferences/important-only-suite.mdreferences/language-details.mdreferences/macos-arm64e-workaround.mdreferences/performance-tuning.mdreferences/quality-assessment.mdreferences/ruleset-catalog.mdreferences/run-all-suite.mdreferences/sarif-processing.mdreferences/threat-models.mdscripts/build_log.shscripts/check_db_quality.pyscripts/find_databases.shscripts/generate_suite.shscripts/pyproject.tomlscripts/test_build_log.pyscripts/test_build_mode_claims.pyscripts/test_check_db_quality.pyscripts/test_find_databases.py
Showing 24 of 34 files. Browse the folder on GitHub.
Suede Skill Check: 92/100 · A
Report snapshot · · graded-v2
The rubric totals 100 points; published scores are capped at 99. Security scan: not scanned.
Source revision: 5c99c03fb8a9. Report version 05680a5060c5. Badge URLs follow the latest listing; save the report to keep this version.
Download report · Request a fresh review
What to review next
- Boundary clause: 0 of 4 points. 4 when the description says when not to use the skill (“Not for …”, “Do not use …”, “Use … instead”).
- Description length: 3 of 5 points. 5 for 150–600 characters; 3 for 100–900; 1 for 50–1,024.
- Compatibility declared: 0 of 2 points. 2 when the frontmatter declares compatibility.
Add declarations and bundled files when they describe the skill’s actual needs. Update the source, then request a fresh review with the changed commit or PR.
codeql passes the required frontmatter check and all seven graded checks, which cover the SKILL.md format, a declared license and a commit in the last year. Those checks earn 56 of the score’s points; the rest come from description quality, instruction depth, bundled files, maintenance and curated-list citations. How the score works.
See the checks and points
| Check | Result |
|---|---|
| Frontmatter parses and declares a name and a description | Pass |
| Name uses lowercase letters, digits and hyphens, 64 characters or fewer | Pass |
| Name matches the skill's folder name | Pass |
| Description is between 50 and 1,024 characters | Pass |
| Description says when an agent should use the skill | Pass |
| SKILL.md body is 500 lines or fewer | Pass |
| A license is declared in the frontmatter or the repository | Pass |
| Repository has a commit in the last 12 months | Pass |
| Score component | Points |
|---|---|
| Structural checks | 56 of 56 |
| Description length | 3 of 5 |
| Boundary clause | 0 of 4 |
| Example request | 3 of 3 |
| Instruction depth | 7 of 7 |
| Reference files | 3 of 3 |
| Bundled scripts | 2 of 2 |
| Recent maintenance | 9 of 9 |
| Curated-list citations | 7 of 7 |
| Tool permissions declared | 2 of 2 |
| Compatibility declared | 0 of 2 |
Two badges for codeql
Choose the numeric badge, the letter badge, or both. Each links to this skill’s Suede listing; either valid linked badge can qualify for the feature offer.
[](https://skills.suedeai.ai/directory/trailofbits/skills/codeql/)
[](https://skills.suedeai.ai/directory/trailofbits/skills/codeql/)<a href="https://skills.suedeai.ai/directory/trailofbits/skills/codeql/"><img src="https://skills.suedeai.ai/directory/trailofbits/skills/codeql/score.svg" alt="Suede Skill Check: 92/100" width="160" height="175"></a>
<a href="https://skills.suedeai.ai/directory/trailofbits/skills/codeql/"><img src="https://skills.suedeai.ai/directory/trailofbits/skills/codeql/badge.svg" alt="Suede Skill Check: Grade A" width="160" height="175"></a>Suede Certified on the shield refers to this published structural quality check. Security scan: not scanned. Read the methodology.
Limited-time feature offer: display either the numeric or letter badge in your repository or skill README (both also qualify), then request badge verification. Eligible skills scoring 80–99 can receive a featured placement after Suede verifies at least one valid badge linked to the skill’s listing. Suede has not announced an end date.
Where this skill is cited
trailofbits/skills appears in 4 curated lists: BehiSecc/awesome-claude-skills, heilcheng/awesome-agent-skills, hesreallyhim/awesome-claude-code, travisvn/awesome-claude-skills.