# Static Analysis > "Reuse this database" - label: " (language: cpp, created: 2026-02-23)" description: "Reuse this database" - label: "Build a new database" description: "Create a fresh database in a new output directory" ``` After selection: - **If user picks an existing database:** Set `$OUTPUT_DIR` to its parent directory (or the directory containing it), set `$DB_NAME` to the selected path, then proceed to extensions → analysis. - **If user picks "Build new":** Resolve a new `$OUTPUT_DIR`, execute b - Skill: `wufufu770/static-analysis` (Agent Skill) - Install (CLI): `npx skillmds@latest add wufufu770/static-analysis` - Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/static-analysis/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - License: Apache-2.0 - Author: wufufu770 (https://skillmd.com/u/wufufu770) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/wufufu770/static-analysis --- ## TL;DR - **目的**："Reuse this database" - label: " (language: cpp, created: 2026-02-23)" description: "Reuse this database" - label: "Build a new database" d - **适用**：通用 - **输入**：目标信息 - **输出**：执行结果 + 证据 - **红线**：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog - **关联**：上游：003-src-session-start → 下游：003-src-session-start（按需调用） ## Workflow This skill has three workflows. **Once a workflow is selected, execute it step by step without skipping phases.** | Workflow | Purpose | |----------|---------| | [build-database](workflows/build-database.md) | Create CodeQL database using build methods in sequence | | [create-data-extensions](workflows/create-data-extensions.md) | Detect or generate data extension models for project APIs | | [run-analysis](workflows/run-analysis.md) | Select rulesets, execute queries, process results | ### Auto-Detection Logic **If user explicitly specifies** what to do (e.g., "build a database", "run analysis on ./my-db"), execute that workflow directly. **Do NOT call `AskUserQuestion` for database selection if the user's prompt already makes their intent clear** — e.g., "build a new database", "analyze the codeql database in static_analysis_codeql_2", "run a full scan from scratch". **Default pipeline for "test", "scan", "analyze", or similar:** Discover existing databases first, then decide. ```bash # Find ALL CodeQL databases by looking for codeql-database.yml marker file # Search top-level dirs and one subdirectory deep FOUND_DBS=() while IFS= read -r yml; do db_dir=$(dirname "$yml") codeql resolve database -- "$db_dir" >/dev/null 2>&1 && FOUND_DBS+=("$db_dir") done < <(find . -maxdepth 3 -name "codeql-database.yml" -not -path "*/\.*" 2>/dev/null) echo "Found ${#FOUND_DBS[@]} existing database(s)" ``` | Condition | Action | |-----------|--------| | No databases found | Resolve new `$OUTPUT_DIR`, execute build → extensions → analysis (full pipeline) | | One database found | Use `AskUserQuestion`: reuse it or build new? | | Multiple databases found | Use `AskUserQuestion`: list all with metadata, let user pick one or build new | | User explicitly stated intent | Skip `AskUserQuestion`, act on their instructions directly | ### Database Selection Prompt When existing databases are found **and the user did not explicitly specify which to use**, present via `AskUserQuestion`: ``` header: "Existing CodeQL Databases" question: "I found existing CodeQL database(s). What would you like to do?" options: - label: " (language: python, created: 2026-02-24)" description: "Reuse this database" - label: " (language: cpp, created: 2026-02-23)" description: "Reuse this database" - label: "Build a new database" description: "Create a fresh database in a new output directory" ``` After selection: - **If user picks an existing database:** Set `$OUTPUT_DIR` to its parent directory (or the directory containing it), set `$DB_NAME` to the selected path, then proceed to extensions → analysis. - **If user picks "Build new":** Resolve a new `$OUTPUT_DIR`, execute build → extensions → analysis. ### General Decision Prompt If the user's intent is ambiguous (neither database selection nor workflow is clear), ask: ``` I can help with CodeQL analysis. What would you like to do? 1. **Full scan (Recommended)** - Build database, create extensions, then run analysis 2. **Build database** - Create a new CodeQL database from this codebase 3. **Create data extensions** - Generate custom source/sink models for project APIs 4. **Run analysis** - Run security queries on existing database [If databases found: "I found N existing database(s): "] [Show output directory: "Output will be stored in "] ``` --- ## Reference Index | File | Content | |------|---------| | **Workflows** | | | [workflows/build-database.md](workflows/build-database.md) | Database creation with build method sequence | | [workflows/create-data-extensions.md](workflows/create-data-extensions.md) | Data extension generation pipeline | | [workflows/run-analysis.md](workflows/run-analysis.md) | Query execution and result processing | | **References** | | | [references/macos-arm64e-workaround.md](references/macos-arm64e-workaround.md) | Apple Silicon build tracing workarounds | | [references/build-fixes.md](references/build-fixes.md) | Build failure fix catalog | | [references/quality-assessment.md](references/quality-assessment.md) | Database quality metrics and improvements | | [references/extension-yaml-format.md](references/extension-yaml-format.md) | Data extension YAML column definitions and examples | | [references/sarif-processing.md](references/sarif-processing.md) | jq commands for SARIF output processing | | [references/diagnostic-query-templates.md](references/diagnostic-query-templates.md) | QL queries for source/sink enumeration | | [references/important-only-suite.md](references/important-only-suite.md) | Important-only suite template and generation | | [references/run-all-suite.md](references/run-all-suite.md) | Run-all suite template | | [references/ruleset-catalog.md](references/ruleset-catalog.md) | Available query packs by language | | [references/threat-models.md](references/threat-models.md) | Threat model configuration | | [references/language-details.md](references/language-details.md) | Language-specific build and extraction details | | [references/performance-tuning.md](references/performance-tuning.md) | Memory, threading, and timeout configuration | --- ## Success Criteria A complete CodeQL analysis run should satisfy: - [ ] Output directory resolved (user-specified or auto-incremented default) - [ ] All generated files stored inside `$OUTPUT_DIR` - [ ] Database built (discovered via `codeql-database.yml` marker) with quality assessment passed (baseline LoC > 0, errors < 5%) - [ ] Data extensions evaluated — either created in `$OUTPUT_DIR/extensions/` or explicitly skipped with justification - [ ] Analysis run with explicit suite reference (not default pack suite) - [ ] All installed query packs (official + Trail of Bits + Community) used or explicitly excluded - [ ] Selected query packs logged to `$OUTPUT_DIR/rulesets.txt` - [ ] Unfiltered results preserved in `$OUTPUT_DIR/raw/results.sarif` - [ ] Final results in `$OUTPUT_DIR/results/results.sarif` (filtered for important-only, copied for run-all) - [ ] Zero-finding results investigated (database quality, model coverage, suite selection) - [ ] Build log preserved at `$OUTPUT_DIR/build.log` with all commands, fixes, and quality assessments ## When to Use - Target presents indicators of the vulnerability class this skill covers - Fingerprint or recon indicates the relevant technology stack is in use - Authorized testing scope covers the target endpoint or component - Findings need to be validated through this skill's methodology ## When NOT to Use - Target is clearly outside this skill's scope (refer to related skills) - No authorization for testing - Need a different category of testing (use related skills)