codeql

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.

Agent Skill from trailofbits/skills

Copilot Studio

Passes documented load rules

No documented load rule failed.

Microsoft 365 Copilot Preview, Frontier tenants only

Needs changes

Fails: Every file has a supported file type (M365-FILE-TYPES)
2 unsupported: assets/trail-of-bits-mark.svg, scripts/pyproject.toml
rule · Microsoft 365 Copilot: Supported file and script types

Warnings (don't change the verdict):

Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
SKILL.md mentions system package install
rule · Microsoft 365 Copilot: Script execution sandbox
Warning: No sign of network access, package installs or authenticated calls (M365-SANDBOX)
declares dependencies (scripts/pyproject.toml); the sandbox can't install packages
rule · Microsoft 365 Copilot: Script execution sandbox

An agent can have at most 8 skills. Custom skills aren't available in tenants that use Microsoft Purview Information Barriers.

Agent Skills spec notes

Warning: No experimental allowed-tools field (SPEC-ALLOWED-TOOLS)
uses allowed-tools
rule · Agent Skills specification

Compatible isn't the same as safe. These verdicts only say whether a skill's files follow Microsoft's documented load rules. The checker reads files and never runs them, and it doesn't review what a skill or its scripts actually do. Read a skill's instructions and scripts before you add it to an agent.

Standards signals

Meets the agentskills.io required fields.

Frontmatter	Present and parsed Spec: frontmatter
name	Meets the spec (1-64 chars, a-z 0-9 hyphens) Spec: name
description	Present, 1-1,024 characters Spec: description
compatibility	Absent or under 500 characters Spec: compatibility
Name matches folder	Yes (`codeql`) Spec: name
allowed-tools	Used Note: experimental in the spec; support varies by agent. Spec: allowed-tools

Observed from the public SKILL.md at the commit above on 2026-10-23. Not a certification: AAIF and the Agent Skills project don't certify skills. Validate your own skill with skills-ref validate.

Source repo	trailofbits/skills
Path	plugins/static-analysis/skills/codeql/SKILL.md
Commit checked	`1e0cb77d071a`
Repo license	CC · we list metadata only
Files	34
Scripts	15 (15 scanned for the sandbox heuristic)
Instructions	17,562 characters
Deepest folder	1 below the skill folder
Rules version	2026-10-22

Re-check the latest version How skill checks work

Is this wrong or out of date? Email us. Skills data built 2026-10-23; rules as of 2026-10-22.

Rule-based checks of public files against Microsoft's documented load rules, not tested in Copilot Studio or Microsoft 365 Copilot. Independent project, not affiliated with Microsoft.