seaworld008
seaworld008/Commonly-used-high-value-skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill codeql-security-scanner命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Multi-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.
Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.
App Store Optimization toolkit for researching keywords, optimizing metadata, and tracking mobile app performance on Apple App Store and Google Play Store.
正在显示 SKILL.md
基于 SOC 职业分类
| name | codeql-security-scanner |
| description | 用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scanning 集成。 |
| zh_description | 用于通过 CodeQL 执行语义代码扫描、安全查询、自定义规则、SARIF 报告和 GitHub Code Scan。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, sast, codeql, code-scanning, github, sarif, custom-queries, appsec] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
Use this skill when the user wants deep semantic code scanning, GitHub Advanced Security style analysis, custom CodeQL queries, SARIF output, or vulnerability investigation with CodeQL databases.
Good trigger phrases:
Inspect the repository:
rg --files | sed -n '1,160p'
Determine:
codeql version
If missing, use official GitHub CodeQL CLI installation guidance. For GitHub-hosted workflows, prefer github/codeql-action.
For compiled languages, provide the real build command:
codeql database create codeql-db --language=java --command="mvn -DskipTests package"
For JavaScript or TypeScript:
codeql database create codeql-db --language=javascript-typescript
For Python:
codeql database create codeql-db --language=python
If database creation fails, fix dependency installation or build steps before analyzing.
Default query suite:
codeql database analyze codeql-db --format=sarif-latest --output=codeql.sarif
Security extended suite:
codeql database analyze codeql-db codeql/javascript-queries:codeql-suites/javascript-security-extended.qls --format=sarif-latest --output=codeql.sarif
Adapt the query pack path to the detected language and installed CodeQL pack layout.
For each alert:
Prioritize:
Use custom queries when a project has its own framework wrappers:
/**
* @name Example dangerous API use
* @kind problem
* @problem.severity warning
* @security-severity 6.0
* @id custom/dangerous-api
*/
import javascript
from CallExpr call
where call.getCalleeName() = "dangerousEval"
select call, "Avoid dangerousEval with untrusted input."
Keep custom queries versioned with tests where possible.
name: codeql
on:
pull_request:
push:
branches: [main]
jobs:
analyze:
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: javascript-typescript
queries: security-extended
- uses: github/codeql-action/analyze@v3
1. Reproduce the alert with CodeQL CLI.
2. Open path explanation and inspect each step.
3. Confirm source is user-controllable.
4. Confirm sink is security-sensitive.
5. Fix with framework-native safe API.
6. Add regression test.
7. Re-run the relevant query.
## CodeQL Alert
- Query:
- Severity:
- Location:
- Source:
- Sink:
- Path summary:
- Exploit condition:
- Fix:
- Test: