20 CodeQL Security Analysis alternatives
CodeQL Security Analysis: Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks. 20 agent skills do similar work, most sharing Security, Audit and Code Quality, ranked by how much they have in common with CodeQL Security Analysis.
Back to CodeQL Security Analysis
-
by Trail of Bits
Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.
Also: Audit, Code Quality, Security, Static Analysis
-
by Trail of Bits
CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.
Also: CodeQL, Security, Static Analysis
-
by Trail of Bits
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
Also: Audit, Security, Static Analysis
-
by Trail of Bits
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
Also: Audit, Security, Static Analysis
-
by Trail of Bits
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
-
by Pillar Security
Pillar Security's SAIL V2 framework as an agent skill: a 91-risk catalogue across seven lifecycle phases, for AI security gap assessments, roadmaps, and ISO 42001 / EU AI Act compliance checklists.
-
by Trail of Bits
Audits npm, PyPI and Go dependencies for advisories, abandoned upstreams, publisher concentration and install-time scripts — measured by scripts, not estimated.
-
by Firebase
Firebase's official red-team skill for auditing Firestore and Cloud Storage security rules — hunting privilege escalation, create/update bypasses and resource-exhaustion holes.
-
by Sentry
Audit GitHub Actions workflows for the exploitation patterns that leak secrets or allow code execution from a fork.
-
by Sentry
Audit the changes on your current branch for bugs, security vulnerabilities, and quality problems before you push.
-
by CodeRabbit
Pull unresolved CodeRabbit review threads from your PR and apply the fixes one at a time, treating every reviewer comment as untrusted input rather than an instruction.
Also: Code Quality
-
by Datadog
Official Datadog skill for investigating one flaky test — pulls its history and failure pattern, categorises the root cause and recommends fixing, quarantining or escalating.
Also: Code Quality
-
by Addy Osmani
Sends every non-trivial decision to a fresh-context adversarial reviewer before it stands — for production, security-sensitive or irreversible work.
Also: Code Quality
-
by Svelte
The Svelte team's own guidance on writing modern Svelte 5 — when to reach for each rune, why effects are an escape hatch, and the reactivity traps models fall into.
Also: Code Quality
-
by Addy Osmani
Reduces accumulated complexity without changing behaviour, using Chesterton's Fence to avoid deleting the thing that was load-bearing.
Also: Code Quality
-
by Cloudflare
Audit Core Web Vitals with real measurements via Chrome DevTools — then fix what the numbers actually point to.
Also: Audit
-
by NVIDIA
Generates or refreshes an NVIDIA governance skill card for an existing agent skill — discovers assets, renders a deterministic markdown card, and blocks submission while human-review markers remain.
Also: Audit
-
by Auth0
Auth0's official agent skill: a router that detects your framework and intent, then loads the right Auth0 guidance for login, MFA, Organizations, tenant audits, debugging or provider migration.
Also: Security
-
by zero-lab
56 evidence-bound security skills in 10 plugins for authorized assessment, red teaming, detection engineering and AI-agent security.
Also: Security
-
by OpenQodex
Open source pre-push AI code review for Claude Code and Codex: scanners plus a separate reviewer that verifies every finding.
Also: Security
