security-static-analysislisted

# Security Static Analysis Skill ## Purpose Detect vulnerabilities before commit using CodeQL, Semgrep, and SARIF processing, backed by manual review of the changed surface. ## When to use Use this skill before merging changes that touch authentication, authorization, user input, file handling, secrets, deserialization, subprocess execution, or dependencies. Also use for a periodic sweep of a whole service. ## Inputs - the diff or codebase under review - language and framework - trust boundaries: what is user-controlled, what is internal - which tools are available and may be run ## Output Return: - findings ranked by severity, each with file and line, the source-to-sink path, a concrete exploit scenario, and the fix - tool findings and manual findings reported separately - an explicit coverage statement: which tools ran, which rule packs, and what was not analysed - items needing human judgement, listed apart from confirmed findings ## Constraints - **CodeQL** for interprocedural taint tracking and data flow; build a database for the target language and run security-extended plus the Trail of Bits and community query packs; write data extension models for project-specific APIs the default models miss - **Semgrep** for fast pattern-based scanning; start from OWASP, CWE, and Trail of Bits rulesets, then write custom YAML rules with taint mode for project-specific source-to-sink pairs - **SARIF** for aggregating and deduplicating across tools; do not hand-merge results - t