Static Analysis

A comprehensive static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection.

CodeQL and Semgrep skills are based on the Trail of Bits Testing Handbook:

• CodeQL Testing Handbook
• Semgrep Testing Handbook

Author: Axel Mierczuk & Paweł Płatek

Skills Included

When to Use

Use this plugin when you need to:

• Perform security vulnerability detection on codebases
• Run CodeQL for interprocedural taint tracking and data flow analysis
• Use Semgrep for fast pattern-based bug detection
• Parse SARIF output from security scanners
• Aggregate and deduplicate findings from multiple tools

What It Does

CodeQL

• Create databases for Python, JavaScript, Go, Java, C/C++, and more
• Run security queries with SARIF/CSV output
• Generate data extension models for project-specific APIs
• Select and combine query packs (security-extended, Trail of Bits, Community)

Semgrep

• Quick security scans using built-in rulesets (OWASP, CWE, Trail of Bits)
• Write custom YAML rules with pattern matching
• Taint mode for tracking data flow from sources to sinks
• CI/CD integration with baseline scanning

SARIF Parsing

• Understand SARIF 2.1.0 structure
• Resolve a result's severity from the rule it inherits it from, which CodeQL relies on
• Quick analysis using jq for CLI queries
• Python scripting with pysarif and sarif-tools
• Aggregate and deduplicate results from multiple files
• CI/CD integration patterns

Running a Semgrep scan

Two entry points over one implementation.

/static-analysis:semgrep-scan {"target": "/abs/path", "mode": "run-all"}

runs the scan end to end: detect languages and Pro, select rulesets, scan, merge, report. It does not stop to have the ruleset list approved — invoking it with a target is the opt-in. That is safe because the scan is read-only over the target: no --autofix, every write inside the output directory, and it refuses to run when the output directory is the target.

Ask for the semgrep skill instead when the ruleset selection is the thing that matters. Its five-step path presents the list and waits for approval before anything runs. Both paths read the same references/, so a ruleset added to rulesets.md reaches both.

Workflows Included

Scripts Included

Generating the commands in one place is what makes --metrics=off, the --include scoping rule, and the output-directory --exclude properties of the code rather than instructions a model can drop.

No subagent runs any part of the scan — the workflow's Scan phase calls run-scans.sh. Exit codes come from the semgrep processes and finding counts from the JSON they wrote, so nothing in the result is a self-report that a later step has to go behind and verify.

Tests

Both suites are hermetic, reach no network, and are discovered by CI's existing shell-suite step.

Installation

/plugin install trailofbits/skills/plugins/static-analysis

Related Skills

• variant-analysis - Use CodeQL/Semgrep patterns to find bug variants