Skip to main content
affpapa.org
RU EN
skill CX Codex

codeql · trailofbits — Claude Code skill: what it does, how to install

Runs interprocedural taint tracking and data flow analysis using CodeQL. Helps detect security flaws across nine programming languages.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill codeql -a claude-code
Open on GitHub

What codeql does

The skill manages the full CodeQL workflow directly from the agent. It extracts database facts, runs query suites, and saves SARIF reports under ./static_analysis_codeql_1. Two scanning targets are supported: an exhaustive run covering quality and experimental queries, or a high-precision run focused on verified vulnerabilities.

Compiled targets such as C/C++, Go, and Java require a valid build. On Apple Silicon, exit code 137 indicates an arm64e mismatch. Running via Rosetta or Homebrew binaries resolves the issue. Dedicated validation scripts verify database extraction immediately to prevent silent query drops.

The workflow writes project-specific data extension models. Without them, CodeQL overlooks tainted data flowing through custom wrappers in Django, Spring, or Express.

What it helps with

  • Track taint and data flow vulnerabilities across whole repositories
  • Build CodeQL databases with automated extraction quality checks
  • Model custom sources and sinks for frameworks like Django or Express
  • Export static analysis findings directly into SARIF reports

Example prompts for the agent

  • Run a codeql scan on this repository
  • Build a codeql database and run the important only query suite
  • Perform taint analysis and report security vulnerabilities

How to install codeql

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill codeql -a claude-code

2Manually: put the files in place

~/.claude/skills/codeql/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/codeql/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about codeql

How do I install codeql in Claude Code?

Run npx skills add trailofbits/skills --skill codeql -a claude-code.

When should I use semgrep instead of codeql?

Choose semgrep for quick single-file pattern matching or when a compiled project lacks a build environment. CodeQL is built for deep interprocedural analysis and taint tracking across files.

Which languages does this skill support?

It handles Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift.

Similar skills

All skills for Security →

codeql by other authors comes first.

codeql official github Walks you through CodeQL code scanning: Actions workflows, CLI commands, SARIF output, and fixing failed analyses. 2,000installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set77

semgrep Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. CX Codex +1 9,500installs differential-review Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. CX Codex +1 8,800installs modern-python Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. CX Codex +1 8,700installs supply-chain-risk-auditor Audits project dependencies for supply-chain risks, including advisories and signs of abandoned packages. Use it before a dependency review or security engagement. CX Codex +1 8,100installs secure-workflow-guide Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. CX Codex +1 7,400installs code-maturity-assessor This skill evaluates smart contracts and blockchain code across nine maturity categories. It produces evidence-backed ratings and a ranked improvement plan. CX Codex +1 7,100installs property-based-testing This skill helps create and inspect tests that check rules across generated inputs. Use it for parsers, serialization pairs, data structures, and Solidity contract invariants. CX Codex +1 7,000installs fp-check Walks a suspected vulnerability through verification and returns a TRUE POSITIVE or FALSE POSITIVE verdict backed by evidence. Built for confirming findings, not hunting new ones. CX Codex +1 7,000installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor