Static Analysis

Comprehensive static analysis toolkit for security vulnerability detection, based on the Trail of Bits Application Security Testing Handbook.

When to Use

• Running security scans on codebases (any language)
• Writing custom CodeQL queries or Semgrep rules
• Processing and triaging SARIF output files from analysis tools
• Setting up static analysis in CI/CD pipelines
• Comparing and aggregating results from multiple tools

When NOT to Use

• Building brand-new detection workflows outside this toolkit's CodeQL, Semgrep, and SARIF scope
• Dynamic analysis or fuzzing (use testing-handbook-skills)
• Smart contract auditing or chain-specific review work

Sub-Skills