Menu
用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scanning 集成。
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill codeql-security-scannerThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Multi-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.
Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.
App Store Optimization toolkit for researching keywords, optimizing metadata, and tracking mobile app performance on Apple App Store and Google Play Store.
Based on SOC occupation classification
| name | codeql-security-scanner |
| description | 用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scanning 集成。 |
| zh_description | 用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scan。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, sast, codeql, code-scanning, github, sarif, custom-queries, appsec] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
Use this skill when the user wants deep semantic code scanning, GitHub Advanced Security style analysis, custom CodeQL queries, SARIF output, or vulnerability investigation with CodeQL databases.
Good trigger phrases:
Inspect the repository:
rg --files | sed -n '1,160p'
Determine:
codeql version
If missing, use official GitHub CodeQL CLI installation guidance. For GitHub-hosted workflows, prefer github/codeql-action.
For compiled languages, provide the real build command:
codeql database create codeql-db --language=java --command="mvn -DskipTests package"
For JavaScript or TypeScript:
codeql database create codeql-db --language=javascript-typescript
For Python:
codeql database create codeql-db --language=python
If database creation fails, fix dependency installation or build steps before analyzing.
Default query suite:
codeql database analyze codeql-db --format=sarif-latest --output=codeql.sarif
Security extended suite:
codeql database analyze codeql-db codeql/javascript-queries:codeql-suites/javascript-security-extended.qls --format=sarif-latest --output=codeql.sarif
Adapt the query pack path to the detected language and installed CodeQL pack layout.
For each alert:
Prioritize:
Use custom queries when a project has its own framework wrappers:
/**
* @name Example dangerous API use
* @kind problem
* @problem.severity warning
* @security-severity 6.0
* @id custom/dangerous-api
*/
import javascript
from CallExpr call
where call.getCalleeName() = "dangerousEval"
select call, "Avoid dangerousEval with untrusted input."
Keep custom queries versioned with tests where possible.
name: codeql
on:
pull_request:
push:
branches: [main]
jobs:
analyze:
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: javascript-typescript
queries: security-extended
- uses: github/codeql-action/analyze@v3
1. Reproduce the alert with CodeQL CLI.
2. Open path explanation and inspect each step.
3. Confirm source is user-controllable.
4. Confirm sink is security-sensitive.
5. Fix with framework-native safe API.
6. Add regression test.
7. Re-run the relevant query.
## CodeQL Alert
- Query:
- Severity:
- Location:
- Source:
- Sink:
- Path summary:
- Exploit condition:
- Fix:
- Test: