Setup & Installation
npx skills add https://github.com/trailofbits/skills --skill static-analysis
https://github.com/trailofbits/skills/tree/main/plugins/static-analysis
View on GitHubWhat This Skill Does
Static analysis toolkit combining CodeQL, Semgrep, and SARIF parsing for security vulnerability detection. Covers taint tracking, data flow analysis, and pattern-based scanning across Python, JavaScript, Go, Java, C/C++, and more. Based on the Trail of Bits Testing Handbook.
Running CodeQL and Semgrep together with SARIF aggregation catches interprocedural vulnerabilities that grep-based or single-tool approaches miss.
When to use it
- Running CodeQL taint analysis to trace user input into SQL queries
- Writing Semgrep rules to catch a specific CWE pattern across a codebase
- Parsing SARIF output from multiple scanners into a deduplicated findings list
- Scanning a pull request with Semgrep against OWASP and Trail of Bits rulesets
- Generating CodeQL data extension models for project-specific API sinks