advanced-security

Effective usage of GitHub API tools for fetching secret scanning alerts and locations.

Guidelines for setting up isolated testing environments for secret validation scripts.

Techniques for analyzing code context around secret locations to understand usage and intent.

Strategies for cloning repositories with full history into the workspace for analysis.

Use the validate-secrets tool for deterministic secret validation when a matching validator is available.

Verification guide specific to HTTP Basic Authentication credentials.

Guidelines for testing secrets that provide access to internal systems and networks.

Template for creating new secret-type-specific verification guides.

Create custom CodeQL query development workshops from production-grade queries. Use this skill to generate guided learning materials with exercises, solutions, and tests that teach developers how to build CodeQL queries incrementally.

Validate that the CodeQL Development MCP Server reliably returns non-empty AST, CFG, and CallGraph data from the bundled tools queries. Use this skill to ensure the `codeql_query_run` tool properly executes PrintAST, PrintCFG, CallGraphFrom, and CallGraphTo queries for any supported language.

Add first-class support for a new CodeQL-supported language to the CodeQL Development MCP Server. Use this skill when CodeQL adds support for a new language (e.g., Rust) and the MCP server needs to provide tool queries, prompts, and resources for that language.

Upgrade the CodeQL CLI version and synchronize all ql-mcp-* pack dependencies to maintain compatibility. Use this skill when a new CodeQL CLI version is released and the MCP server needs to be updated to use it.

Maintain the CHANGELOG.md file by drafting or updating entries for new stable releases. Use this skill when preparing a release, after merging significant PRs, or when moving changes from Unreleased to a new version section.