A comprehensive pipeline for CodeQL static analysis, vulnerability triaging, and query optimization.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install codeql-skill
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install codeql-skill using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CodeQL Security Audit Skill?
The CodeQL Security Audit Skill provides a sophisticated interface for performing deep static analysis on software repositories. By leveraging the power of Openclaw Skills, this tool integrates repository scanning, result triaging, and query tuning into a seamless workflow. It is designed to identify complex vulnerabilities through taint tracking and source-to-sink analysis.
This skill is particularly effective for developers and security researchers who need to go beyond basic linting. It supports multiple languages including Java, JavaScript, Python, and C++, ensuring broad coverage across modern tech stacks within the Openclaw Skills framework.
CodeQL Security Audit Skill Use Cases
- Automating security scans on internal or open-source repositories to find zero-day vulnerabilities.
- Triaging SARIF output from GitHub Actions or other CI/CD pipelines to prioritize critical fixes.
- Developing and debugging custom CodeQL queries to find specific architectural flaws.
- Documenting exploit chains by extracting source-to-sink evidence from complex data flows.
How CodeQL Security Audit Skill Works
- The user initiates a scan using the SCAN mode, which detects the project language and builds a CodeQL database.
- The skill runs selected security suites to generate a standardized SARIF output file.
- In the AUDIT phase, the SARIF results are parsed and grouped by vulnerability family to inventory the attack surface.
- The agent reviews suspicious entries and generates remediation code or proof-of-concept requests based on context.
- If custom queries are used, the TUNE mode provides a seven-check optimization loop to refine performance and accuracy.
CodeQL Security Audit Skill Setup
To get started with this component of Openclaw Skills, ensure you have the CodeQL CLI installed. Then, use the following commands:
Run a repository scan:
bash scripts/scan.sh <repo_path> [language] [output.sarif]
Triage the results:
python3 scripts/audit.py <results.sarif> --output exp.md
Optimize your queries:
python3 scripts/tune.py <query.ql>
CodeQL Security Audit Skill Data Schema & Taxonomy
| Component | Description |
|---|---|
| .ql files | Custom logic for identifying specific vulnerability patterns. |
| .sarif files | Standardized JSON output containing scan results and data flow information. |
| exp.md | A generated report summarizing the attack surface and evidence chains. |
| CodeQL DB | A relational representation of the source code used for querying. |
CodeQL Security Audit Skill Advanced Features
- Automated language detection and build command selection for streamlined database creation.
- Taint tracking analysis to visualize data movement from untrusted sources to sensitive sinks.
- Integrated tuning checklist to improve query coverage and reduce false positives within the Openclaw Skills ecosystem.
- Support for custom security suites and language-specific reference documentation for Java, JS, Python, and C++.
SKILL.md
Loading
Related Openclaw Skills
Privacy Protector
A robust utility for PII anonymization, local de-anonymization, and deterministic local detector checks for various text and file formats.
Skill Audit
A deterministic static safety auditor for Openclaw Skills designed to screen third-party repositories for security risks before installation.
Security Live Safety Check
A robust backend-backed safety gate that validates risky AI agent instructions before execution to prevent destructive or unauthorized actions.
SkillBoss
A unified API and CLI tool to access over 50 AI models across image, video, voice, and text providers with intelligent cost-saving routing.
Lightcloud API Integration
A cross-platform skill for managing Qingyun/Lightcloud form documents and authentication via AI coding agents.
Scenique Prevision
A sophisticated decision forecasting engine that utilizes Menos architecture and swarm intelligence to simulate outcomes in a digital sandbox.
Featured*
