Use the open-source CodeQL ecosystem for .NET security analysis.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/19/2026
What it changes
Passed 10 of 15 test cases with the skill, and 12 of 15 without it.
Without skill77%
With skill68%
Checks it passed that the model alone missed
The response specifies using command -v codeql to check for local installation.
1 fixed14 passed either way4 still failing3 broke
Pass-rate lift
-9 pp
Tokens
+11%
Agent turns
0%
Response time
-39%
Model gemini-3.6-flashMeasured 8/19/2026v115 of 22 cases passed with skill · 15 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
When bootstrapping local CodeQL query development for a C# project, what command verifies if the local CodeQL executable is installed in the system PATH?
What was checked, without and with the skill
Checked
Without skill
With skill
The response specifies using command -v codeql to check for local installation.
Missed
Passed
case-19 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md96 lines4 files
CodeQL for .NET
Trigger On
the repo uses or wants CodeQL for .NET security analysis
GitHub code scanning is part of the CI plan
Value
produce a concrete project delta: code, docs, config, tests, CI, or review artifact
reduce ambiguity through explicit planning, verification, and final validation skills
leave reusable project context so future tasks are faster and safer
Do Not Use For
teams that need a tool with no private-repo licensing caveat
Inputs
the nearest AGENTS.md
hosting model: open-source repo, private repo, or manual CLI workflow
current GitHub Actions workflow
Quick Start
Read the nearest AGENTS.md and confirm scope and constraints.
Run this skill's Workflow through the Ralph Loop until outcomes are acceptable.
Return the Required Result Format with concrete artifacts and verification evidence.
Workflow
Treat CodeQL as a security-analysis tool, not as a style checker.
Make the licensing and hosting model explicit before proposing it as the default gate.
Prefer manual build mode for compiled .NET projects when precision matters.
Use free built-in .NET maintainability analyzers and code metrics configuration to find overly complex methods and coupled code. USE FOR: the team wants to find overly complex methods; cyclomatic complexity thresholds are needed in CI; maintainability metrics or coupling thresholds need to be configured. DO NOT USE FOR: formatting-only work; generic analyzer setup with no complexity policy change. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, o