codeql-pattern-finderlisted

# codeql-pattern-finder The query-discovery and query-authoring side of the CodeQL pair. Most org-specific patterns already exist as community queries; this skill finds them. When they don't, it sketches a custom query — emphasis on *sketch*, not production-ready, since custom CodeQL is a real authoring project requiring tuning. ## When to use - A repeated incident pattern (post-mortems mention the same vulnerability class) — find or build a query. - A regulator-specific control (e.g., PCI-DSS Req 3.4 on PAN protection) — find a query that approximates the control. - A specific deprecation campaign (move off an internal API that's known-bad) — build a query. - Planning a custom pack for the org — start by enumerating which patterns even need to be custom vs covered already. ## When NOT to use - Setting up CodeQL on a repo for the first time → `codeql-onboarding-helper`. - Triaging a specific alert — not in scope. - Non-code-pattern questions (process / policy) — those are research, not CodeQL. ## Workflow 1. **Categorize the pattern**: vulnerability class (SQL injection, XSS, deserialization) OR business rule (specific API usage, specific data-flow constraint) OR deprecation campaign. 2. **Search the standard `github/codeql` repo** for an existing query in the relevant language pack (e.g., `java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql`). 3. **Search community packs** at `codeql-packs/*` (e.g., `codeql-packs/log4j-vuln-pack`) for ecosystem-specific patterns. 4. *