# Codeql

> CodeQL security audit pipeline: static scanning, SARIF triage, and QL query optimization. Trigger on: CodeQL, .ql, .sarif, taint tracking, source→sink, LGTM, GitHub Code Scanning, "scan this repo", "analyze this vulnerability", "optimize this query".

- Skill: `dvcrn/codeql` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add dvcrn/codeql`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dvcrn/codeql/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: dvcrn (https://skillmd.com/u/dvcrn)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/dvcrn/codeql

---


# CodeQL Security Audit Skill

Three independent modes — identify which one the user needs and run the corresponding script.

| User Intent | Mode | Script |
|-------------|------|--------|
| Scan a repo / create a DB / generate SARIF | **[SCAN]** | `scripts/scan.sh` |
| Read SARIF / triage vulns / generate report | **[AUDIT]** | `scripts/audit.py` |
| Optimize or debug a .ql query file | **[TUNE]** | `scripts/tune.py` |

---

## [SCAN]

```bash
bash scripts/scan.sh <repo_path> [language] [output.sarif]
# language: java | javascript | python | cpp | auto (default)
```

The script handles: language detection → build command selection → CodeQL DB creation → security suite scan → SARIF output.

For writing **custom queries**, refer to the relevant language reference:
`references/lang-java.md` / `lang-javascript.md` / `lang-python.md` / `lang-cpp.md`

---

## [AUDIT]

```bash
python3 scripts/audit.py <results.sarif> --output exp.md
```

The script handles: SARIF parsing → attack surface inventory → vuln family grouping → source→sink evidence chain extraction → exp.md output.

**Claude's responsibility** (what the script cannot do):
- Manually assess `[SUSPICIOUS]` entries with no data flow — determine if they are real vulnerabilities
- Write POC requests based on business context
- Provide concrete remediation code

---

## [TUNE]

```bash
python3 scripts/tune.py <query.ql>
```

The script outputs a tuning checklist covering seven checks: coverage, false positives, performance, and metadata completeness.

**Claude's responsibility** (what the script cannot do):
- Rewrite source / sink / sanitizer logic based on checklist findings
- Debug queries with no results or unexpected output — refer to `references/debugging.md`