36 skills · sorted by relevance
Set up CodeQL security scanning in GitHub Actions or with the local CLI. Get guidance on language settings, build steps, analysis rules, result uploads, and troubleshooting so you can configure scans and interpret their findings.
Edit and validate Bazel build settings using conventions specific to CodeQL development. Follow established helpers for packaging and operating system differences, add dependencies with checksums, and check changed targets while respecting the standalone build setup.
Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
The English summary is being prepared. Showing the original description.
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
The English summary is being prepared. Showing the original description.
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
The English summary is being prepared. Showing the original description.
Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.
Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.
Run CodeQL static analysis for security vulnerability detection, taint tracking, and data flow analysis. Use when asked to analyze code with CodeQL, create CodeQL databases, write custom QL queries, perform security audits, or set up CodeQL in CI/CD pipelines.
The English summary is being prepared. Showing the original description.
Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.
Run CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF. Use when CodeQL is explicitly requested; use security-review for a broader manual security review.
The English summary is being prepared. Showing the original description.
Use the open-source CodeQL ecosystem for .NET security analysis. Use when a repo needs CodeQL query packs, CLI-based analysis on open source codebases, or GitHub Action setup with explicit licensing caveats. USE FOR: the repo uses or wants CodeQL for .NET security analysis; GitHub code scanning is part of the CI plan. DO NOT USE FOR: teams that need a tool with no private-repo licensing caveat. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.
The English summary is being prepared. Showing the original description.
Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.
Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.
Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.
The English summary is being prepared. Showing the original description.
bu skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and establishing quality gates that block merges when high-severity vulnerabilities are Detected.
The English summary is being prepared. Showing the original description.
Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability Tespit across repositories at enterprise scale.
The English summary is being prepared. Showing the original description.
Triage and fix Dependabot alerts and CodeQL findings in the ai repository. Use when the user asks to address security vulnerabilities, fix Dependabot alerts, resolve CodeQL issues, or do security maintenance.
The English summary is being prepared. Showing the original description.
Investigate queued or slow OpenClaw CI jobs, the automated checks run during development. Use measured evidence to adjust runner capacity, registration budgets, parallel job limits, test grouping, and placement between GitHub-hosted runners and Blacksmith.
Compare multiple NemoClaw pull requests addressing the same issue. It checks merge eligibility, correctness, quality, and attribution, then produces an evidence-based recommendation for merging or choosing a candidate for further repair.
Helps review application code, authentication, access controls, and dependencies for security flaws. Uses OWASP guidance and CVE reports, records of known vulnerabilities, to assess impact and recommend practical fixes.
Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.
Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube. Identify security vulnerabilities in source code before deployment. Use when implementing secure SDLC, code review automation, or security gates in CI/CD pipelines.
The English summary is being prepared. Showing the original description.