Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add boshi-xixixi/TraeSkill --skill codeqlgit clone --depth 1 https://github.com/boshi-xixixi/TraeSkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boshi-xixixi/traeskill/codeql)<a href="https://agentmods.dev/skills/boshi-xixixi/traeskill/codeql"><img src="https://agentmods.dev/badge/skills/boshi-xixixi/traeskill/codeql/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boshi-xixixi/traeskill/codeql"><img src="https://agentmods.dev/badge/skills/boshi-xixixi/traeskill/codeql.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.03215 |
| Opus 5 | $0.00032 | $0.01607 |
| Sonnet 5 | $0.00013 | $0.00643 |
| Haiku 4.5 | $0.00006 | $0.00321 |
Grade A, and why
codeql scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 406 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodeQL Code Scanning
This skill provides procedural guidance for configuring and running CodeQL code scanning — both through GitHub Actions workflows and the standalone CodeQL CLI.
When to Use This Skill
Use this skill when the request involves:
- Creating or customizing a
codeql.ymlGitHub Actions workflow - Choosing between default setup and advanced setup for code scanning
- Configuring CodeQL language matrix, build modes, or query suites
- Running CodeQL CLI locally (
codeql database create,database analyze,github upload-results) - Understanding or interpreting SARIF output from CodeQL
- Troubleshooting CodeQL analysis failures (build modes, compiled languages, runner requirements)
- Setting up CodeQL for monorepos with per-component scanning
- Configuring dependency caching, custom query packs, or model packs
Supported Languages
CodeQL supports the following language identifiers:
| Language | Identifier | Alternatives |
|---|---|---|
| C/C++ | c-cpp |
c, cpp |
| C# | csharp |
— |
| Go | go |
— |
| Java/Kotlin | java-kotlin |
java, kotlin |
| JavaScript/TypeScript | javascript-typescript |
javascript, typescript |
| Python | python |
— |
| Ruby | ruby |
— |
| Rust | rust |
— |
| Swift | swift |
— |
| GitHub Actions | actions |
— |
Alternative identifiers are equivalent to the standard identifier (e.g.,
javascriptdoes not exclude TypeScript analysis).
Core Workflow — GitHub Actions
Step 1: Choose Setup Type
- Default setup — Enable from repository Settings → Advanced Security → CodeQL analysis. Best for getting started quickly. Uses
nonebuild mode for most languages. - Advanced setup — Create a
.github/workflows/codeql.ymlfile for full control over triggers, build modes, query suites, and matrix strategies.
To switch from default to advanced: disable default setup first, then commit the workflow file.
Step 2: Configure Workflow Triggers
Define when scanning runs:
on:
push:
branches: [main, protected]
pull_request:
branches: [main]
schedule:
- cron: '30 6 * * 1' # Weekly Monday 6:30 UTC
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 406 lines · 64 tokens per session scan A 81503394c7c0
codeql is a skill published in the GitHub repository boshi-xixixi/TraeSkill (262 stars, last pushed 4mo ago), licensed MIT. It adds 64 tokens to every session and 3,215 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
<skill-name>
A template for defining a coding-agent skill, including its title, trigger situations, overview, workflow, common mistakes, and optional references.
spec-writing
A method for writing a software specification: a document that records decisions, reasons, boundaries, and ways to judge whether implementation succeeded. It first checks whether important unknowns require user clarification or technical research.
onboarding-unknown-codebase
A method for quickly understanding an unfamiliar codebase, meaning a software project whose structure and behavior you do not yet know. It builds a project map by examining overview files, directories, and one main execution path.
commit-message
A guide for writing clear, traceable Git commit messages using the Conventional Commits format, which labels changes such as features, bug fixes, documentation, and refactoring.
clarifying-questions
Guidance for clarifying vague or assumption-heavy requests before making changes.
debugging
A systematic method for finding the underlying cause of a software bug by observing the failure, forming a hypothesis, and testing it.