The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes various build commands (including make, cmake, gradle, mvn, cargo, and dotnet) to trace compilation for CodeQL database creation. These commands are essential for the tool's primary purpose of analyzing compiled languages and are executed within the user's project context.
[EXTERNAL_DOWNLOADS]: The workflows automate the retrieval of CodeQL query packs from trusted organizations such as GitHub Security Lab and Trail of Bits. It also uses standard language-specific package managers (pip, npm, go mod) to fetch dependencies required to build the target project.
[DATA_EXFILTRATION]: The skill incorporates a safety-first approach by providing instructions to exclude sensitive files like .env and .git from the database extraction process, minimizing the risk of credential exposure in analysis artifacts.
[PROMPT_INJECTION]: The skill processes untrusted source code and build manifests which constitutes an indirect prompt injection surface. However, it mitigates risks through strict validation steps, baseline LoC comparisons, and extractor error assessments to ensure data integrity.

codeql