codeql
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "fi
- License
- CC-BY-SA-4.0
- SKILL.md tokens
- 4,617
- Bundled files
- 33
- Bundled tokens (estimated)
- 56,868
Cost per 1,000 loads
Estimated input cost per 1,000 loads of SKILL.md only (characters ÷ 4). Bundled files, output tokens and execution are excluded.
| Model | Input / 1M tokens | 1,000 loads |
|---|---|---|
| Claude Opus 5 | $5.00 | $23.09 |
| Claude Sonnet 5 | $2.00 | $9.23 |
| Claude Haiku 4.5 | $1.00 | $4.62 |
Safety flags
Detected automatically from files; not a security audit.
- Runs scripts
- Yes
- Network access
- Yes
- Shell commands
- Yes
Works with
Open SKILL.md format
- Claude Code
- Codex
- Cursor
- GitHub Copilot
- Gemini CLI
- OpenCode
- Goose
Install
npx skills add trailofbits/skills --skill codeqlLast verified:
codeql FAQ
What does the codeql skill do?
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "fi Source: https://github.com/trailofbits/skills/blob/main/plugins/static-analysis/skills/codeql/SKILL.md
What does the codeql skill cost to load?
SKILL.md is about 4,617 tokens. Estimated input cost per 1,000 loads: Claude Opus 5 $23.09; Claude Sonnet 5 $9.23; Claude Haiku 4.5 $4.62. Estimated input cost per 1,000 loads of SKILL.md only (characters ÷ 4). Bundled files, output tokens and execution are excluded. Prices: https://docs.anthropic.com/en/docs/about-claude/pricing
How do I install the codeql skill?
Skills CLI: npx skills add trailofbits/skills --skill codeql. Claude Code: /plugin marketplace add trailofbits/skills, then install the plugin from that marketplace. Download the codeql skill folder as a ZIP and upload it in Claude.ai skills settings.
Is the codeql skill safe?
Automatically detected flags: runs scripts, network access, shell commands. Flags are detected automatically from the skill's files and are not a security audit; review the SKILL.md before installing.