CodeQL Skill (Trail of Bits) for Claude Code: What It Does and How to Install It

Makes Claude scan a codebase for security bugs with CodeQL: build a database, add project-specific models, run queries and report SARIF results.

Installs: 8.5K; on skills.sh
Stars: 7.9K; on GitHub
Files: 33; besides SKILL.md
Updated: Oct 2026; last repo commit

This is Trail of Bits' CodeQL skill, not an official GitHub one. It has Claude pick an output folder, find or build a CodeQL database, check that the database really extracted your code, look for missing models of your own APIs, and run an explicit query suite in "run all" or "important only" mode. Results are written as SARIF.

It needs the codeql CLI, jq and uv on your machine. For compiled languages it runs your project's build, so it is a poor fit for a machine where you do not want builds to run. The same plugin also holds the semgrep and sarif-parsing skills.

Good for

Security engineers who want CodeQL taint-tracking scans run step by step
Developers scanning Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby or Swift repos
Auditors who need to know whether a zero-finding scan really means zero

Install codeql

Claude Code

Copy this prompt.

Install the codeql skill in Claude Code. Run this command:

/plugin marketplace add trailofbits/skills
/plugin install static-analysis@trailofbits

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires codeql CLI, jq and uv.

Pick one route. The plugin route installs static-analysis: 3 skills (codeql, semgrep, sarif-parsing) and 2 workflow commands, with no hooks or MCP config in the plugin folder. The skills CLI and folder routes install only codeql. Whichever you choose, install the codeql CLI, jq and uv first (SKILL.md lists gh extension install github/gh-codeql, brew install --cask codeql or the codeql-bundle). There is no Claude app upload route because the skill runs the CLI and shell scripts.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.

Sections in SKILL.md

Essential Principles
Each Bash call is a fresh shell
Output Directory
Database Discovery
Quick Start
Rationalizations to Reject
Workflow Selection
Building unattended
Auto-Detection Logic
Database Selection Prompt
General Decision Prompt
Reference Index
Success Criteria

Key facts

Author: Trail of Bits (plugin author: Axel Mierczuk and Pawel Platek)
Repo: trailofbits/skills
License: CC-BY-SA-4.0 (LICENSE and README agree)
Installs on skills.sh: 8,548 (Nov 2, 2026)
GitHub stars: 7,954 for the whole repo (Nov 2, 2026)
Last repo commit: Oct 28, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
What it includes: 34 files including SKILL.md: 3 workflows, 12 references, 5 scripts and 10 test files for them, pyproject.toml, an agents/openai.yaml and a logo
Needs: codeql CLI, jq and uv on PATH (SKILL.md checks all three first)
Part of: The static-analysis plugin: 3 skills (codeql, semgrep, sarif-parsing) and 2 workflow commands

What it includes

Stops early if codeql, jq or uv is missing from PATH.
Runs code · Preflight checks
Writes everything to static_analysis_codeql_N or a folder you name.
Picks the next free number so earlier runs are not overwritten.
Write · Output directory
Lists CodeQL databases already on disk and asks which to reuse.
Uses scripts/find_databases.sh and the codeql-database.yml marker.
Files · Find existing databases
Tries autobuild, a custom build command, multi-step tracing, then no-build mode.
Runs your project's own build (make, cmake, gradle, mvn, cargo, dotnet). Go and Swift do not allow no-build mode.
Try: “Build a CodeQL database for this repo”
Runs code · Build database workflow
Cleans build output, removes the database and installs the project's dependencies.
build-fixes.md runs make clean, mvn clean, cargo clean, rm -rf on build folders, pip install and npm install.
Delete · Build fixes
Uses a Homebrew toolchain or Rosetta when system tools crash CodeQL tracing.
Offers brew install llvm make or softwareupdate --install-rosetta as options.
Runs code · macOS Apple Silicon workaround
Fails a database that extracted no source code.
scripts/check_db_quality.py, run with uv after every build.
Runs code · Database quality check
Finds sources and sinks CodeQL misses and writes YAML models for them.
Five steps ending with a baseline versus extension comparison.
Runs code · Create data extensions
Shows one plan, then runs the scan in "run all" or "important only" mode.
Uses generate_suite.sh and verify_query_suite.py to build an explicit .qls suite.
Try: “Run a full CodeQL scan on this repo”
Runs code · Run analysis workflow
Offers Trail of Bits and community packs when they are installed.
ruleset-catalog.md lists codeql pack download commands for them; SKILL.md says to ask the user to install or ignore.
Runs code · Query packs
Writes raw/results.sarif and results/results.sarif plus a build log.
Zero findings must be investigated before they are reported as clean.
Write · Results
Plugin command that runs the whole build step without asking questions.
Only present when the static-analysis plugin is installed.
Runs code · /static-analysis:codeql-build

From the official docs

Permissions

High risk

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It runs your build and can clean it
The build workflow runs make, cmake, gradle, mvn, cargo or dotnet. build-fixes.md also runs make clean, mvn clean, cargo clean and rm -rf on build and CMake folders. Run it in a clone or a clean checkout. github.com
It installs dependencies for you
To improve extraction it runs pip install -r requirements.txt, pip install -e ., npm install, go mod download and Gradle or Maven dependency commands, plus pip install of type stubs. Use a virtual environment or container. github.com
macOS fixes can install tools
The Apple Silicon reference offers brew install llvm make or softwareupdate --install-rosetta as choices. Say no if you do not want system changes. github.com
The plugin command asks nothing
SKILL.md says /static-analysis:codeql-build asks nothing and drives the build to a conclusion. Use the skill by hand if you want a say in each build method. github.com
Query packs come from other publishers
The ruleset catalog lists codeql pack download for Trail of Bits and GitHubSecurityLab packs. The run-analysis workflow asks whether to install a missing pack or ignore it. github.com
The plugin route adds the semgrep and sarif-parsing skills
The static-analysis plugin holds 3 skills and 2 workflow commands. Its README says the semgrep skill's run-scans.sh builds the semgrep commands, clones third-party rule repos and runs scans in batches. The skills CLI and folder routes install only codeql. github.com

Technical details

Turning on read-only	No read-only mode. Building a database writes files and runs your build.
Sign-in and keys	SKILL.md names no account or API key.
Scopes	Runs your project's build commands to trace compilation Writes the database, logs and SARIF into a new output folder Removes the database and cleans build output in your project when a build fails Installs the project's own dependencies with pip, npm and similar

Questions

What does the codeql skill do?

It makes Claude run a CodeQL scan in order: build a database, check its quality, add data extensions for your own APIs, then run an explicit query suite. Supported languages are Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby and Swift.

Is this GitHub's CodeQL skill?

No. It is in the Trail of Bits skills repo. It drives the CodeQL CLI, which you install yourself.

How do I install it?

Use the install box at the top of this page. The repo documents a plugin marketplace route. The plugin is static-analysis and holds this skill, semgrep and sarif-parsing, plus two workflow commands. You also need the codeql CLI, jq and uv.

How do I install the codeql CLI?

SKILL.md lists gh extension install github/gh-codeql followed by gh codeql install-stub, brew install --cask codeql, or the codeql-bundle download from the codeql-action releases page.

Does it work in the Claude app?

The install box has no Claude app upload route. The skill runs the codeql CLI, shell scripts and your build on your machine.

Is it safe?

It runs your project build, can clean build folders and installs dependencies. Work in a disposable checkout or container and read the build commands Claude plans to run.

codeql skill vs semgrep skill?

SKILL.md sends you to the semgrep skill for fast single-file pattern matching, or when a compiled language has no build available. Use codeql when you need interprocedural data flow and taint tracking.

Why does it distrust a scan with zero findings?

SKILL.md says zero findings can mean poor extraction, missing models, wrong packs or suite filtering. It requires a database quality check and a suite check, and the report must say both passed.

Information

updated Nov 2, 2026

Repository: trailofbits/skills
Folder: plugins/static-analysis/skills/codeql

trailofbits/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 10

trailofbits/skills README · github.com
static-analysis plugin README · github.com
trailofbits/skills marketplace.json · github.com
codeql SKILL.md · github.com
build-database workflow · github.com
run-analysis workflow · github.com
build-fixes reference · github.com
macOS arm64e workaround · github.com
quality-assessment reference · github.com
ruleset-catalog reference · github.com