| name | codeql-security-scanner |
| description | 用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scanning 集成。 |
| zh_description | 用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scan。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, sast, codeql, code-scanning, github, sarif, custom-queries, appsec] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
CodeQL Security Scanner
Trigger / When to Use
Use this skill when the user wants deep semantic code scanning, GitHub Advanced Security style analysis, custom CodeQL queries, SARIF output, or vulnerability investigation with CodeQL databases.
Good trigger phrases:
- "run CodeQL locally"
- "add CodeQL code scanning"
- "scan JavaScript for security issues"
- "write a CodeQL query"
- "upload SARIF to GitHub"
- "investigate a CodeQL alert"
Core Capabilities
- Build CodeQL databases for supported languages.
- Run default and security-extended query suites.
- Produce SARIF reports for GitHub code scanning.
- Investigate dataflow-based vulnerabilities.
- Author and test custom queries for recurring insecure patterns.
- Integrate scans in GitHub Actions or local CI.
Workflow
1. Identify Languages
Inspect the repository:
rg --files | sed -n '1,160p'
Determine:
- Primary language.
- Build command.
- Whether generated code should be excluded.
- Whether dependencies need to be installed before database creation.
- Whether multiple CodeQL databases are required for a polyglot repo.
2. Verify CodeQL CLI
codeql version
If missing, use official GitHub CodeQL CLI installation guidance. For GitHub-hosted workflows, prefer github/codeql-action.
3. Create a Database
For compiled languages, provide the real build command:
codeql database create codeql-db --language=java --command="mvn -DskipTests package"
For JavaScript or TypeScript:
codeql database create codeql-db --language=javascript-typescript
For Python:
codeql database create codeql-db --language=python
If database creation fails, fix dependency installation or build steps before analyzing.
4. Run Queries
Default query suite:
codeql database analyze codeql-db --format=sarif-latest --output=codeql.sarif
Security extended suite:
