CodeQL Security Analysis

关于

The CodeQL Security Analysis skill empowers Claude Code to perform professional-grade security audits by processing Static Analysis Results Interchange Format (SARIF) data. Unlike basic linting, this skill enables Claude to trace untrusted data from its source through multiple function boundaries to dangerous sinks using semantic analysis. It helps developers distinguish between true positives and false alarms, assesses the severity of findings based on architectural context, and provides language-specific remediation patterns for critical vulnerabilities like SQL injection, path traversal, and command injection, ensuring a more secure and robust codebase.

主要功能

• Provides context-aware remediation code for various injection attacks
• Interprets SARIF output files from CodeQL CLI
• 5 GitHub stars
• Traces cross-function dataflow and taint propagation paths
• Maps security findings to CWE standards and vulnerability classes
• Distinguishes true positives from false positives based on sanitization

使用场景

• Remediating deep-seated SQL injection and path traversal flaws
• Validating security patches against identified dataflow paths
• Automated security auditing of large, complex codebases