# Trail of Bits Static Analysis

> Draft · awaiting review.

> Claude Code plugin that drives CodeQL, Semgrep and SARIF parsing to find security vulnerabilities in a codebase.

- Badge: `reach ≥2 · not run yet`
- Type: Plugin; tier: not run yet
- Tasks: Code review and static analysis (SAST); mission: Defensive; works with: Claude Code, Codex
- Source: https://github.com/trailofbits/skills (plugins/static-analysis), pinned to `5c99c03` (1.5.0), licence CC-BY-SA-4.0
- Last checked: 2026-10-19; next check: 2027-01-17; method v0.1, reach-v0.1

## At a glance

- **What it is:** A static analysis toolkit plugin with CodeQL, Semgrep and SARIF parsing for security vulnerability detection. A plugin bundles skills, commands, hooks or MCP servers for one AI client.
- **Made for:** Detects security vulnerabilities in codebases. +2 more
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools. Other modes: unattended Semgrep scan; unattended CodeQL build.
- **Sends data to:** Semgrep registry (by default), Third-party Semgrep rule repositories (by default), CodeQL pack registry (if you turn it on), Target project's package registries (if you turn it on), Homebrew (if you turn it on). Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, deletes, runs commands, according to the capabilities read.
- **Needs:** Ships as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility · The CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle) · The CodeQL skill also requires jq and uv on PATH · +5 more

Profile read at commit `5c99c03` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

A static analysis toolkit plugin with CodeQL, Semgrep and SARIF parsing for security vulnerability detection. (plugins/static-analysis/.claude-plugin/plugin.json#L4)

Made for (the author says):

- Detects security vulnerabilities in codebases. (plugins/static-analysis/README.md#L23)
- Runs CodeQL for interprocedural taint tracking and data flow analysis, and Semgrep for pattern-based bug detection. (plugins/static-analysis/README.md#L24-25)
- Parses SARIF output and aggregates and deduplicates findings from several tools. (plugins/static-analysis/README.md#L26-27)

Documented uses:

- Scan a repository with CodeQL: build the database, create data extensions, then run the analysis. [Code review and static analysis (SAST)] (plugins/static-analysis/skills/codeql/SKILL.md#L170)
- Run a Semgrep security audit of a codebase, or find vulnerabilities before code review. [Code review and static analysis (SAST)] (plugins/static-analysis/skills/semgrep/SKILL.md#L32-33)
- Read, aggregate and deduplicate SARIF findings from several security scanners. [Code review and static analysis (SAST)] (plugins/static-analysis/skills/sarif-parsing/SKILL.md#L18-20)
- Build a CodeQL database when the build is the long, uncertain part and should be driven to a conclusion. [Code review and static analysis (SAST)] (plugins/static-analysis/skills/codeql/SKILL.md#L218-220)

Not for (the author says):

- The semgrep skill is not meant for binary analysis. (plugins/static-analysis/skills/semgrep/SKILL.md#L39)
- The sarif-parsing skill does not run scans; it processes existing SARIF results. (plugins/static-analysis/skills/sarif-parsing/SKILL.md#L28)
- The semgrep skill points projects that already run Semgrep in CI to their existing pipeline. (plugins/static-analysis/skills/semgrep/SKILL.md#L40)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| codeql | Deep security analysis with taint tracking and data flow. (plugins/static-analysis/README.md#L16) | reads, changes, deletes, runs commands | yes |
| semgrep | Pattern-based security scanning with Semgrep. (plugins/static-analysis/README.md#L17) | reads, changes, deletes, runs commands | yes |
| sarif-parsing | Parses and processes results from static analysis tools. (plugins/static-analysis/README.md#L18) | reads, runs commands | yes |
| /static-analysis:semgrep-scan | Workflow shipped as /static-analysis:semgrep-scan with four phases: Detect, Select, Scan, Report. (plugins/static-analysis/README.md#L72) | reads, changes, deletes, runs commands | yes |
| /static-analysis:codeql-build | /static-analysis:codeql-build walks the build-method ladder (autobuild, custom command, multi-step, no-build), retrying at each rung, then enforces the quality gate. (plugins/static-analysis/README.md#L73) | reads, changes, deletes, runs commands | yes |

## How it runs

The semgrep-scan workflow's Scan phase calls run-scans.sh; exit codes come from the semgrep processes and finding counts from the JSON they wrote. (plugins/static-analysis/README.md#L86-88)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Runs inside the AI client as skill instructions; the codeql skill lists Bash, Read, Write and Edit among its allowed-tools. (plugins/static-analysis/skills/codeql/SKILL.md#L13)
- Can also run: Inside your AI client: its model follows the instructions and works with the client's own tools (unattended Semgrep scan, switch `/static-analysis:semgrep-scan`). The semgrep-scan workflow runs the whole Semgrep scan without the ruleset approval gate that the semgrep skill enforces. (plugins/static-analysis/skills/semgrep/SKILL.md#L167-171)
- Can also run: Inside your AI client: its model follows the instructions and works with the client's own tools (unattended CodeQL build, switch `/static-analysis:codeql-build`). The codeql-build workflow builds the database without asking and returns statuses such as no-method-succeeded or built-below-threshold. (plugins/static-analysis/skills/codeql/SKILL.md#L213-216)
- Your AI client: **Skills: codeql, semgrep, sarif-parsing**: SKILL.md files with reference and workflow documents that the client model follows step by step. (plugins/static-analysis/skills/codeql/SKILL.md#L20)
- Your AI client: **Workflows: semgrep-scan.js, codeql-build.js**: Plugin workflow script shipped as /static-analysis:semgrep-scan, namespaced by the plugin's name field. (plugins/static-analysis/workflows/semgrep-scan.js#L1-3)
- Your machine: **Bundled bash and Python scripts**: run-scans.sh runs the selected Semgrep rulesets, generates every semgrep command, and reports what each scan produced. (plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L2-4)
- Your machine: **CodeQL CLI**: The codeql CLI on PATH; the skill stops if it is missing and names gh-codeql, the Homebrew cask or codeql-bundle as install routes. (plugins/static-analysis/skills/codeql/SKILL.md#L141-147)
- Your machine: **Semgrep CLI**: Semgrep CLI, required and checked with semgrep --version. (plugins/static-analysis/skills/semgrep/SKILL.md#L89)
- Outside your machine: **Third-party Semgrep rule repositories**: Git repositories with Semgrep rules that run-scans.sh shallow-clones into the output directory at scan time. (plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L409)
- Sends data to Semgrep registry (download, by default): semgrep resolves p/ ruleset identifiers such as p/default against the Semgrep registry when it runs. (plugins/static-analysis/skills/semgrep/workflows/scan-workflow.md#L73-76)
- Sends data to Third-party Semgrep rule repositories (download, by default): run-scans.sh shallow-clones each third-party rule repository URL with git clone --depth 1. (plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L409)
- Sends data to CodeQL pack registry (download, if you turn it on): Trail of Bits CodeQL query packs (cpp, go, java) are fetched with codeql pack download. (plugins/static-analysis/skills/codeql/references/ruleset-catalog.md#L27-31)
- Sends data to Target project's package registries (download, if you turn it on): When a build fails, the fix catalog installs the target project's dependencies with its own package manager. (plugins/static-analysis/skills/codeql/references/build-fixes.md#L35)
- Sends data to Homebrew (download, if you turn it on): After the user picks the option, the macOS arm64e path installs llvm and make with Homebrew before retrying the build. (plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md#L178-186)

## What you need

- Runtime: Ships as a Claude Code plugin marketplace; Codex can load the same marketplace through its Claude marketplace compatibility. (README.md#L3)
- Other tools: The CodeQL skill stops unless the codeql CLI is on PATH (gh-codeql extension, Homebrew cask or codeql-bundle). (plugins/static-analysis/skills/codeql/SKILL.md#L141-147)
- Other tools: The CodeQL skill also requires jq and uv on PATH. (plugins/static-analysis/skills/codeql/SKILL.md#L151-160)
- Other tools: The Semgrep skill requires the Semgrep CLI. (plugins/static-analysis/skills/semgrep/workflows/scan-workflow.md#L68-71)
- Other tools: For C/C++, Java/Kotlin, C# and Rust, complete extraction needs a build CodeQL can trace; --build-mode=none gives partial analysis. (plugins/static-analysis/skills/codeql/workflows/build-database.md#L23-26)
- Runtime: The codeql skill's two Python scripts declare Python 3.11 or later and run standalone under uv run. (plugins/static-analysis/skills/codeql/scripts/pyproject.toml#L4-10)
- Account: Semgrep Pro is optional; it enables cross-file taint tracking, inter-procedural analysis and Apex, C# and Elixir. (plugins/static-analysis/skills/semgrep/SKILL.md#L91)
- Credentials: When the target's dependencies come from a private registry, the CodeQL build-fix step asks the user to configure registry authentication and retry, or to skip them. (plugins/static-analysis/skills/codeql/references/build-fixes.md#L84-92)
- Installer: Claude Code: add the trailofbits/skills marketplace with /plugin marketplace add, then pick the plugin from /plugin menu. (README.md#L11-18)
- Installer: The plugin README gives a one-line install by repository path: /plugin install trailofbits/skills/plugins/static-analysis. (plugins/static-analysis/README.md#L102)
- Installer: Codex: codex plugin marketplace add trailofbits/skills, then codex plugin add <plugin-name>@trailofbits. (README.md#L27-31)

## Limits and risks

- To fix a failed CodeQL build, the skill installs the target project's dependencies (pip install -r requirements.txt, pip install -e ., npm install). (plugins/static-analysis/skills/codeql/references/build-fixes.md#L45-54)
- For compiled languages the CodeQL build methods run the target project's own build (autobuild, custom command, multi-step tracing). (plugins/static-analysis/skills/codeql/workflows/build-database.md#L27-32)
- run-scans.sh accepts third_party entries that match an https URL pattern allowing any host name and port, and exits otherwise. (plugins/static-analysis/skills/semgrep/scripts/run-scans.sh#L279-282)
- Semgrep OSS mode cannot track data flow across files; cross-file analysis needs Semgrep Pro. (plugins/static-analysis/skills/semgrep/SKILL.md#L105)
- Semgrep sends telemetry by default and --config auto also phones home, so the skill requires --metrics=off on every semgrep command. (plugins/static-analysis/skills/semgrep/SKILL.md#L23)
- The build-fix catalog cleans build state in the target project (make clean, rm -rf build CMakeCache.txt CMakeFiles, gradlew, mvn and cargo clean). (plugins/static-analysis/skills/codeql/references/build-fixes.md#L23-30)
- As a workaround for pre-compiled packs, the CodeQL skill copies generated data extension YAML into the ext/ directory inside CodeQL's managed pack cache. (plugins/static-analysis/skills/codeql/references/extension-yaml-format.md#L154-156)
- To locate run-scans.sh, the semgrep-scan workflow checks the plugin root and plugin cache and, as a fallback, searches the home directory to depth 9. (plugins/static-analysis/workflows/semgrep-scan.js#L203-212)
- If the user picks the Rosetta option on an affected Apple Silicon Mac, the CodeQL skill runs softwareupdate --install-rosetta --agree-to-license before retrying the build. (plugins/static-analysis/skills/codeql/references/macos-arm64e-workaround.md#L190-198)
- As a database quality improvement, the CodeQL skill pip-installs the type stubs types-requests, types-PyYAML and types-redis into the target project's environment. (plugins/static-analysis/skills/codeql/references/quality-assessment.md#L163-170)
- The sarif-parsing skill's schema validation example installs ajv-cli globally with npm install -g. (plugins/static-analysis/skills/sarif-parsing/SKILL.md#L379-382)
- The semgrep-scan workflow scans the current working directory when no target is given, and by default creates its output directory beside the target. (plugins/static-analysis/workflows/semgrep-scan.js#L9)
- The Semgrep ruleset selection adds third-party rule repositories (Trail of Bits, 0xdea, Decurity and others) automatically whenever the language matches and marks them as not optional. (plugins/static-analysis/skills/semgrep/references/rulesets.md#L122-130)

## Rights in plain language

- Declared: files 1 (reads outside the project), network 1 (talks only to declared hosts), execution 2 (runs shell commands or eval), approval 2 (has broad pre-approvals).
- Code: reach ≥2 (open): files 2 (writes outside the project), network 2 (talks to any host), execution 2 (runs shell commands or eval), persistence 2 (changes config or installs globally), approval 2 (has broad pre-approvals); unknown: secrets.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 2 (open), one right unknown.

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | 1 reads outside the project | 2 writes outside the project | not run yet |
| Network: whom does it talk to? | 1 talks only to declared hosts | 2 talks to any host | not run yet |
| Execution: what does it run? | 2 runs shell commands or eval | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | not declared | ? unknown | not run yet |
| Persistence: what survives the run? | not declared | 2 changes config or installs globally | not run yet |
| Approval: does it ask before acting? | 2 has broad pre-approvals | 2 has broad pre-approvals | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L12-18` at the pinned commit (not a command to copy): `/plugin marketplace add trailofbits/skills
/plugin menu`


### Run it with least privilege

- claude code: `run only against code you trust; keep the Semgrep ruleset-approval gate on and review the cloned third-party rule repos before scanning`
- codex: `sandbox_mode=workspace-write; allow outbound only to the rule repositories listed in references/rulesets.md`
- note: `derived from the code, not tested in the lab`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Trail of Bits Static Analysis declare?**

files 1 (reads outside the project), network 1 (talks only to declared hosts), execution 2 (runs shell commands or eval), approval 2 (has broad pre-approvals).

**What does its code suggest?**

reach ≥2 (open): files 2 (writes outside the project), network 2 (talks to any host), execution 2 (runs shell commands or eval), persistence 2 (changes config or installs globally), approval 2 (has broad pre-approvals); unknown: secrets.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-10-15; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: claude_code: run only against code you trust; keep the Semgrep ruleset-approval gate on and review the cloned third-party rule repos before scanning; codex: sandbox_mode=workspace-write; allow outbound only to the rule repositories listed in references/rulesets.md; note: derived from the code, not tested in the lab

Method: https://readbeforerun.ai/method/