--- title: "CodeQL: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-codeql/ description: "Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files." --- # CodeQL: review, setup & limitations · Undominated.ai > Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files. [← Explore all skills](/skills/) SECURITY REVIEW / Trail of Bits # CodeQL Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Revision 82fe82262526 [Read what was—and wasn’t—checked ↓](#review) “Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - A heading states that each Bash call is a fresh shell. - The workflow includes an output directory rather than relying on chat memory. ### A good fit for - Running a CodeQL database you already built - Refusing a scan result that was not written to the output directory - Diagnose zero-result scans caused by missing extraction or hidden suite filters ### Weigh up before choosing - CC-BY-SA-4.0 applies to adaptations you redistribute. - This review did not build a CodeQL database. - A successful database build alone does not prove relevant source was extracted. The checker uses heuristic extractor-error thresholds and a fallback toolchain-path filter when source roots are absent. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/static-analysis/skills/codeql/SKILL.md - README.md - LICENSE - plugins/static-analysis/skills/codeql/scripts/check_db_quality.py ### Our findings - Headings include Essential Principles and Workflow Selection. - The inspected description names interprocedural data flow. - The check_db_quality.py assessment and CLI were inspected: zero baseline/project files fail, excessive extractor errors have a distinct exit, and finalised is reported as a metric rather than itself enforcing rejection. - Generated files must go in OUTPUT_DIR, and a database must be discovered by its marker file rather than assumed to be named codeql.db. ### Not established by this review - The skill was not executed inside a host agent. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md) DOCUMENTED COMMAND /plugin marketplace add trailofbits/skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - In Claude Code, add the upstream marketplace, then use /plugin menu to select the static-analysis plugin. Adding a marketplace alone does not install a plugin. - The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow. - Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task. ### Before you start - CodeQL, jq, uv, the full static-analysis plugin and a compatible build toolchain; an eligible CodeQL licence for the target repository. ### Compatibility Claude Code plugin workflow · Other hosts require compatible plugin/tool support ### Local Markdown instructions - Read the installed skill files - Build target source, create CodeQL databases and execute queries; generated databases and SARIF can contain source. ### Cost model Source is free to read under the stated licence. A host agent may charge for use. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/SKILL.md Supports: Workflow and stated scope - [Repository licence ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Checked 2026-10-07 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE Supports: Redistribution terms - [Install instructions ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md) Checked 2026-10-07 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md Supports: Documented install path - [plugins/static-analysis/skills/codeql/scripts/check_db_quality.py ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/scripts/check_db_quality.py) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/static-analysis/skills/codeql/scripts/check_db_quality.py Supports: review, limitations, access, install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Algorand vulnerability scanner ↗ Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.](/skills/trailofbits-algorand-vulnerability-scanner/)[### False Positive Check ↗ Forces a true-positive or false-positive verdict on one suspected bug, and refuses to be used as a bug hunter.](/skills/trailofbits-fp-check/)[### Post-patch validation ↗ Requires a baseline-versus-patched evidence contract before a security fix is called done.](/skills/trailofbits-post-patch-validation/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)