# Static Analysis

> Static Analysis

- Skill: `comeonoliver/static-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add comeonoliver/static-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/comeonoliver/static-analysis/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ComeOnOliver (https://skillmd.com/u/comeonoliver)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/comeonoliver/static-analysis

---

# Static Analysis

Comprehensive static analysis toolkit for security vulnerability detection, based on the [Trail of Bits Application Security Testing Handbook](https://appsec.guide/).

## When to Use

- Running security scans on codebases (any language)
- Writing custom CodeQL queries or Semgrep rules
- Processing and triaging SARIF output files from analysis tools
- Setting up static analysis in CI/CD pipelines
- Comparing and aggregating results from multiple tools

## When NOT to Use

- Writing Semgrep rules from scratch (use semgrep-rule-creator skill instead)
- Dynamic analysis or fuzzing (use testing-handbook-skills)
- Smart contract auditing (use security-building-secure-contracts)

## Sub-Skills

| Tool | Purpose | Best For | Skill Path |
|------|---------|----------|------------|
| **CodeQL** | Semantic code analysis with database queries | Deep data flow tracking, taint analysis, cross-function analysis | [skills/codeql/SKILL.md](skills/codeql/SKILL.md) |
| **Semgrep** | Fast pattern-matching static analysis | Quick scans, custom rules, CI integration, lightweight checks | [skills/semgrep/SKILL.md](skills/semgrep/SKILL.md) |
| **SARIF Parsing** | Parse and process SARIF result files | Aggregating results, CI/CD integration, multi-tool triage | [skills/sarif-parsing/SKILL.md](skills/sarif-parsing/SKILL.md) |

## Tool Selection Guide

| Scenario | Recommended Tool |
|----------|-----------------|
| Quick security scan | Semgrep |
| Deep vulnerability analysis | CodeQL |
| Data flow / taint tracking | CodeQL (best) or Semgrep taint mode |
| Custom pattern detection | Semgrep (simpler) or CodeQL (more powerful) |
| CI/CD integration | Semgrep (fastest) + CodeQL (thorough) |
| Processing scan results | SARIF Parsing |
| Non-building codebase | Semgrep (works on incomplete code) |

## Quick Start

### Semgrep (fast scan)
```bash
# Install
pip install semgrep

# Run with recommended rulesets
semgrep --config=auto .

# Run specific ruleset
semgrep --config=p/security-audit .
```

### CodeQL (deep analysis)
```bash
# Create database
codeql database create mydb --language=python --source-root=.

# Run security queries
codeql database analyze mydb codeql/python-queries:codeql-suites/python-security-extended.qls --format=sarif-latest --output=results.sarif
```

### SARIF Processing
```bash
# Parse results with jq
jq '.runs[].results[] | {ruleId, message: .message.text, location: .locations[0].physicalLocation.artifactLocation.uri}' results.sarif
```

## Workflow

1. **Quick scan** with Semgrep for fast results
2. **Deep analysis** with CodeQL for thorough coverage
3. **Aggregate results** using SARIF parsing
4. **Triage findings** by severity and exploitability
5. **Custom rules** for project-specific patterns

## Related Skills

- **semgrep-rule-creator** - Dedicated skill for writing production-quality Semgrep rules
- **variant-analysis** - Find similar vulnerabilities using CodeQL/Semgrep patterns
- **security-differential-review** - Security-focused code review using static analysis findings