The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides the agent with instructions and automated scripts to execute shell commands for language detection, directory management, and CodeQL lifecycle operations. It supports a comprehensive array of build systems including Make, CMake, Gradle, Maven, Cargo, .NET, and Xcode to facilitate deep interprocedural analysis.
[EXTERNAL_DOWNLOADS]: The documentation references downloading CodeQL query packs from established and trusted GitHub organizations, such as Trail of Bits and GitHub Security Lab. It also guides the agent to install dependencies for the project being analyzed using standard package managers (e.g., pip, npm, go mod) which is necessary for CodeQL to correctly trace the build process.
[INDIRECT_PROMPT_INJECTION]: As a static analysis tool, the skill is naturally exposed to untrusted data in the form of the codebase it analyzes. The workflows involve executing project-supplied build scripts (like Makefiles), which presents an inherent but expected surface for code analysis tools. The skill mitigates this by including a 'Quality Assessment' phase to verify the integrity and completeness of the extracted data before proceeding with analysis.
[DYNAMIC_EXECUTION]: A utility script, scripts/test_shell_blocks.py, uses the Python compile() function to statically lint Python code snippets embedded within the documentation's markdown files, ensuring the instructional content is syntactically correct without actually executing the code.

codeql