Skip to content
Trail of Bits Static Analysis

Trail of Bits Static Analysis Skill

by Trail of Bits trailofbits/skills plugins/static-analysis

CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.

GitHub Docs
Featured Testing & QASecurity
Released
v1.4.5
CC-BY-SA-4.0

Install

Install with the skills CLI

One command for Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf and dozens of other agents. Needs Node.js; the skill is fetched straight from trailofbits/skills.

$ npx skills add trailofbits/skills --skill static-analysis

Run it in a terminal. The CLI finds the agents installed on your machine, asks which ones to add the skill to, and whether to install it into the folder you ran it from or for all your projects.

Other ways to install

Copy the whole skill folder — SKILL.md and any scripts or references beside it — into ~/.claude/skills/static-analysis/, where Claude Code picks it up in every project. Only git is needed.

tmp=$(mktemp -d) && \
  git clone --depth 1 --branch main https://github.com/trailofbits/skills.git "$tmp" && \
  mkdir -p ~/.claude/skills && \
  cp -R "$tmp"/plugins/static-analysis ~/.claude/skills/static-analysis

No scripts or references next to it? Saving the SKILL.md alone as ~/.claude/skills/static-analysis/SKILL.md works too.

Using another agent? Its personal skills folder
Codex
~/.agents/skills/
Cursor
~/.cursor/skills/
GitHub Copilot
~/.copilot/skills/
Gemini CLI
~/.gemini/skills/
Windsurf
~/.codeium/windsurf/skills/
OpenCode
~/.config/opencode/skills/
Open folder on GitHub

About

  • CodeQL databases and security query packs for Python, JS, Go, Java and C/C++
  • Semgrep fast scanning with OWASP/CWE/Trail of Bits rulesets, custom rules and taint mode
  • SARIF 2.1.0 parsing to aggregate, deduplicate and resolve severities across tools
  • Packaged semgrep-scan and codeql-build workflows with a quality gate
  • Read-only scans with hermetic, network-free test suites

Trail of Bits' Static Analysis is a security-focused agent skill that gives a coding assistant a real vulnerability-hunting toolkit rather than generic advice. It bundles three capabilities: CodeQL for deep interprocedural taint tracking and data-flow analysis (building databases for Python, JavaScript, Go, Java and C/C++, then running security-extended and Trail of Bits query packs), Semgrep for fast pattern-based scanning with OWASP, CWE and Trail of Bits rulesets plus custom YAML rules and taint mode, and SARIF parsing to aggregate, deduplicate and triage findings across tools with correct severity resolution.

The skills are distilled from the Trail of Bits Testing Handbook, so the guidance reflects how a professional security-audit firm actually runs these tools. Two packaged workflows — semgrep-scan and codeql-build — drive an end-to-end, read-only scan and walk the CodeQL build-method ladder (autobuild, custom command, multi-step, no-build) with a quality gate, and the scan commands live in versioned scripts so critical flags like metrics-off and output-directory exclusions can't be dropped by the model.

It is aimed at developers and security engineers who want auditor-grade static analysis wired into Claude Code or another agent harness. Authored by Axel Mierczuk and Paweł Płatek and published under CC-BY-SA-4.0; install with /plugin install trailofbits/skills/plugins/static-analysis.

SKILL.md

The instructions your agent loads, as published by Trail of Bits.

SKILL.md

Static Analysis

A comprehensive static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection.

CodeQL and Semgrep skills are based on the Trail of Bits Testing Handbook:

Author: Axel Mierczuk & Paweł Płatek

Skills Included
SkillPurpose
codeqlDeep security analysis with taint tracking and data flow
semgrepFast pattern-based security scanning
sarif-parsingParse and process results from static analysis tools
When to Use

Use this plugin when you need to:

  • Perform security vulnerability detection on codebases
  • Run CodeQL for interprocedural taint tracking and data flow analysis
  • Use Semgrep for fast pattern-based bug detection
  • Parse SARIF output from security scanners
  • Aggregate and deduplicate findings from multiple tools
What It Does
CodeQL
  • Create databases for Python, JavaScript, Go, Java, C/C++, and more
  • Run security queries with SARIF/CSV output
  • Generate data extension models for project-specific APIs
  • Select and combine query packs (security-extended, Trail of Bits, Community)
Semgrep
  • Quick security scans using built-in rulesets (OWASP, CWE, Trail of Bits)
  • Write custom YAML rules with pattern matching
  • Taint mode for tracking data flow from sources to sinks
  • CI/CD integration with baseline scanning
SARIF Parsing
  • Understand SARIF 2.1.0 structure
  • Resolve a result's severity from the rule it inherits it from, which CodeQL relies on
  • Quick analysis using jq for CLI queries
  • Python scripting with pysarif and sarif-tools
  • Aggregate and deduplicate results from multiple files
  • CI/CD integration patterns
Running a Semgrep scan

Two entry points over one implementation.

/static-analysis:semgrep-scan {"target": "/abs/path", "mode": "run-all"}

runs the scan end to end: detect languages and Pro, select rulesets, scan, merge, report. It
does not stop to have the ruleset list approved — invoking it with a target is the opt-in. That
is safe because the scan is read-only over the target: no --autofix, every write inside the
output directory, and it refuses to run when the output directory is the target.

Ask for the semgrep skill instead when the ruleset selection is the thing that matters. Its
five-step path presents the list and waits for approval before anything runs. Both paths read
the same references/, so a ruleset added to rulesets.md reaches both.

Workflows Included
WorkflowPurpose
workflows/semgrep-scan.jsShips as /static-analysis:semgrep-scan. Four phases: Detect, Select, Scan, Report
workflows/codeql-build.jsShips as /static-analysis:codeql-build. Three phases: Detect, Build, Assess. Walks the build-method ladder — autobuild, custom command, multi-step, no-build — diagnosing and retrying at each rung, then enforces the quality gate
Scripts Included
ScriptPurpose
skills/semgrep/scripts/run-scans.shBuilds every semgrep command from the selected rulesets, clones the third-party rule repos, runs the scans in batches and writes scans.json
skills/semgrep/scripts/merge_sarif.pyMerges the per-scan SARIF into one results.sarif

Generating the commands in one place is what makes --metrics=off, the --include scoping
rule, and the output-directory --exclude properties of the code rather than instructions a
model can drop.

No subagent runs any part of the scan — the workflow's Scan phase calls run-scans.sh. Exit
codes come from the semgrep processes and finding counts from the JSON they wrote, so nothing in
the result is a self-report that a later step has to go behind and verify.

Tests

Both suites are hermetic, reach no network, and are discovered by CI's existing shell-suite step.

SuiteCovers
tests/run_scan_tests.shrun-scans.sh: command generation via --dry-run, plus execution, exit codes and clone failures against stub semgrep and git binaries
tests/run_workflow_tests.shsemgrep-scan.js, via tests/workflow-harness.js, which compiles it with stubbed globals. --self-test mutates the workflow and requires every mutation to turn a scenario red
Installation
/plugin install trailofbits/skills/plugins/static-analysis
Related Skills
  • variant-analysis - Use CodeQL/Semgrep patterns to find bug variants
Install

Related Skills

See all Trail of Bits Static Analysis alternatives

Skill: Semgrep Rule Creator

by Trail of Bits

Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation.

Security

Skill: Zeroize Audit

by Trail of Bits

Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.

Security

Skill: Constant-Time Analysis

by Trail of Bits

Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.

Security
Browse all skills →