Agent skill · software engineering · github
codeql
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
Why this skill is useful
Provides specific CodeQL CLI commands and GitHub Actions workflow configurations that the AI wouldn't reliably generate on its own.
What it needs
Requires codeql installed locally. Requires github account access. About 7k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
CodeQL Code Scanning This skill provides procedural guidance for configuring and running CodeQL code scanning — both through GitHub Actions workflows and the standalone CodeQL CLI. When to Use This Skill Use this skill when the request involves: Creating or customizing a codeql.yml GitHub Actions workflow Choosing between default setup and advanced setup for code scanning Configuring CodeQL language matrix, build modes, or query suites Running CodeQL CLI locally (codeql database create, database analyze, github upload-results) Understanding or interpreting SARIF output from CodeQL Troubleshooting CodeQL analysis failures (build modes, compiled languages, runner requirements) Setting up CodeQL for monorepos with per-component scanning Configuring dependency caching, custom query packs, or model packs Supported Languages CodeQL supports the following language identifiers: Language Identifier Alternatives --- --- --- C/C++ c-cpp c, cpp C# csharp — Go go — Java/Kotlin java-kotlin java, kotlin JavaScript/TypeScript javascript-typescript javascript, typescript Python python — Ruby ruby — Rust rust — Swift swift — GitHub Actions actions — Alternative identifiers are equivalent to the standard identifier (e.g., javascript does not exclude TypeScript analysis). Core Workflow — GitHub Actions Step 1: Choose Setup Type Default setup — Enable from repository Settings → Advanced Security → CodeQL analysis. Best for getting started quickly. Uses none build mode for most languages. Advanced setup — Create a .github/workflows/codeql.yml file for full control over triggers, build modes, query suites, and matrix strategies. To switch from default to advanced: disable default setup first, then commit the workflow file. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/codeql