Static Analysis

TL;DR

• 目的："Reuse this database" - label: " (language: cpp, created: 2026-02-23)" description: "Reuse this database" - label: "Build a new database" d
• 适用：通用
• 输入：目标信息
• 输出：执行结果 + 证据
• 红线：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog
• 关联：上游：003-src-session-start → 下游：003-src-session-start（按需调用）

Workflow

This skill has three workflows. Once a workflow is selected, execute it step by step without skipping phases.

Auto-Detection Logic

If user explicitly specifies what to do (e.g., "build a database", "run analysis on ./my-db"), execute that workflow directly. Do NOT call AskUserQuestion for database selection if the user's prompt already makes their intent clear — e.g., "build a new database", "analyze the codeql database in static_analysis_codeql_2", "run a full scan from scratch".

Default pipeline for "test", "scan", "analyze", or similar: Discover existing databases first, then decide.

# Find ALL CodeQL databases by looking for codeql-database.yml marker file
# Search top-level dirs and one subdirectory deep
FOUND_DBS=()
while IFS= read -r yml; do
  db_dir=$(dirname "$yml")
  codeql resolve database -- "$db_dir" >/dev/null 2>&1 && FOUND_DBS+=("$db_dir")
done < <(find . -maxdepth 3 -name "codeql-database.yml" -not -path "*/\.*" 2>/dev/null)

echo "Found ${#FOUND_DBS[@]} existing database(s)"

Database Selection Prompt

When existing databases are found and the user did not explicitly specify which to use, present via AskUserQuestion:

header: "Existing CodeQL Databases"
question: "I found existing CodeQL database(s). What would you like to do?"
options:
  - label: "<db_path_1> (language: python, created: 2026-02-24)"
    description: "Reuse this database"
  - label: "<db_path_2> (language: cpp, created: 2026-02-23)"
    description: "Reuse this database"
  - label: "Build a new database"
    description: "Create a fresh database in a new output directory"

After selection:

• If user picks an existing database: Set $OUTPUT_DIR to its parent directory (or the directory containing it), set $DB_NAME to the selected path, then proceed to extensions → analysis.
• If user picks "Build new": Resolve a new $OUTPUT_DIR, execute build → extensions → analysis.

General Decision Prompt

If the user's intent is ambiguous (neither database selection nor workflow is clear), ask:

I can help with CodeQL analysis. What would you like to do?

1. **Full scan (Recommended)** - Build database, create extensions, then run analysis
2. **Build database** - Create a new CodeQL database from this codebase
3. **Create data extensions** - Generate custom source/sink models for project APIs
4. **Run analysis** - Run security queries on existing database

[If databases found: "I found N existing database(s): <list paths with language>"]
[Show output directory: "Output will be stored in <OUTPUT_DIR>"]

Reference Index

Success Criteria

A complete CodeQL analysis run should satisfy:

• Output directory resolved (user-specified or auto-incremented default)
• All generated files stored inside $OUTPUT_DIR
• Database built (discovered via codeql-database.yml marker) with quality assessment passed (baseline LoC > 0, errors < 5%)
• Data extensions evaluated — either created in $OUTPUT_DIR/extensions/ or explicitly skipped with justification
• Analysis run with explicit suite reference (not default pack suite)
• All installed query packs (official + Trail of Bits + Community) used or explicitly excluded
• Selected query packs logged to $OUTPUT_DIR/rulesets.txt
• Unfiltered results preserved in $OUTPUT_DIR/raw/results.sarif
• Final results in $OUTPUT_DIR/results/results.sarif (filtered for important-only, copied for run-all)
• Zero-finding results investigated (database quality, model coverage, suite selection)
• Build log preserved at $OUTPUT_DIR/build.log with all commands, fixes, and quality assessments

When to Use

• Target presents indicators of the vulnerability class this skill covers
• Fingerprint or recon indicates the relevant technology stack is in use
• Authorized testing scope covers the target endpoint or component
• Findings need to be validated through this skill's methodology

When NOT to Use

• Target is clearly outside this skill's scope (refer to related skills)
• No authorization for testing
• Need a different category of testing (use related skills)