SECURITY REVIEW / Trail of Bits
CodeQL
Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files.
“Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.”
01 / THE REASONING
Why this made the selection.
- A heading states that each Bash call is a fresh shell.
- The workflow includes an output directory rather than relying on chat memory.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/static-analysis/skills/codeql/SKILL.md
- README.md
- LICENSE
- plugins/static-analysis/skills/codeql/scripts/check_db_quality.py
Our findings
- Headings include Essential Principles and Workflow Selection.
- The inspected description names interprocedural data flow.
- The check_db_quality.py assessment and CLI were inspected: zero baseline/project files fail, excessive extractor errors have a distinct exit, and finalised is reported as a metric rather than itself enforcing rejection.
- Generated files must go in OUTPUT_DIR, and a database must be discovered by its marker file rather than assumed to be named codeql.db.
Not established by this review
- The skill was not executed inside a host agent.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- In Claude Code, add the upstream marketplace, then use /plugin menu to select the static-analysis plugin. Adding a marketplace alone does not install a plugin.
- The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow.
- Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task.
Before you start
- CodeQL, jq, uv, the full static-analysis plugin and a compatible build toolchain; an eligible CodeQL licence for the target repository.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: Redistribution terms
- Install instructions ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md
Supports: Documented install path
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/scripts/check_db_quality.py
Supports: review, limitations, access, install