CodeQL Security Scan
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
Runs the codecrucible CLI for LLM-backed security scans of a repository, checks scope and cost first with a dry run, and reads the SARIF results.
Install CodeCrucible Security Scans
$ npx skills add block/codecrucible --skill codecrucible -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install block/codecrucible codecrucible --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/block/codecrucible.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/codecrucible .claude/skills/codecrucible && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "codecrucible" agent skill from https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucible into .claude/skills/codecrucible/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "codecrucible", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucibleType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add block/codecrucible --skill codecrucible -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install block/codecrucible codecrucible --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/block/codecrucible.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/codecrucible .agents/skills/codecrucible && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "codecrucible" agent skill from https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucible into .agents/skills/codecrucible/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "codecrucible", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add block/codecrucible --skill codecrucible -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install block/codecrucible codecrucible --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/block/codecrucible.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/codecrucible .cursor/skills/codecrucible && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "codecrucible" agent skill from https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucible into .cursor/skills/codecrucible/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "codecrucible", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/block/codecrucible.git --path .agents/skills/codecrucible--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add block/codecrucible --skill codecrucible -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install block/codecrucible codecrucible --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/block/codecrucible.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/codecrucible .gemini/skills/codecrucible && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "codecrucible" agent skill from https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucible into .gemini/skills/codecrucible/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "codecrucible", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install block/codecrucible codecrucibleInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add block/codecrucible --skill codecrucible -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/block/codecrucible.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/codecrucible .github/skills/codecrucible && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "codecrucible" agent skill from https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucible into .github/skills/codecrucible/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "codecrucible", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add block/codecrucible --skill codecrucible -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install block/codecrucible codecrucible --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/block/codecrucible.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/codecrucible .opencode/skills/codecrucible && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "codecrucible" agent skill from https://github.com/block/codecrucible/tree/main/.agents/skills/codecrucible into .opencode/skills/codecrucible/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "codecrucible", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
codecrucible- GitHub stars
- 117
- Token cost
- ~1.2k tokens
- SKILL.md length
- 456 words
- Files
- 1
- Skills in repo
- 1
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Runs the codecrucible CLI for LLM-backed security scans of a repository, checks scope and cost first with a dry run, and reads the SARIF results.
- Works in 8 steps: Identify the target repository,… → Read the target repository's agent… → Inspect the CodeCrucible repository docs… → …
- Scanning a repository with CodeCrucible and reading the SARIF output
- SKILL.md covers Workflow, Selection Guidance, Provider And Config Rules and Reading Results, plus 1 more section
- Calls make
What it does
The agent treats CodeCrucible output as evidence to check against the source, not as a final verdict. It starts by pinning down the target repository, scope, output destination and whether this is an exploratory scan or a CI gate, reads the target's own agent instructions, and consults the CodeCrucible README and PROMPT_SETS.md before choosing flags. It uses the ./codecrucible binary, running make build on a fresh checkout, and lists provider models rather than inventing model IDs.
A dry run comes first and reports scope plus token and cost estimates, so paths can be narrowed with --paths, --include or --exclude. The real scan writes SARIF to an explicit output path and can keep per-phase artifacts. Guidance covers picking a prompt set, such as the default one for first-pass coverage or the exploit-proof sets for precision-oriented, language-specific reviews, using cheaper models for feature detection and stronger ones for analysis, setting --max-cost for exploratory runs and --fail-on-severity only for gating. API keys stay in environment variables, and findings are verified in source before they are reported.
When your agent uses it
- Scanning a repository with CodeCrucible and reading the SARIF output
- Estimating the token usage and cost of a scan before running it
- Choosing a provider, model or prompt set for a scan
- Explaining CodeCrucible findings or phase artifacts
- Wiring a scan into CI with a failing exit code on severity
Example prompts
- “Do a CodeCrucible dry run on ../payments-service and tell me the estimated cost.”
- “Scan the api folder only and write the SARIF to /tmp/results.sarif.”
- “Explain which of these CodeCrucible findings are real after checking them against the source.”
Requirements
- The codecrucible binary, built with make build
- An API key for an LLM provider, held in an environment variable
Workflow steps
8 steps, taken from the first numbered list in SKILL.md.
- Identify the target repository, requested scope, output destination, and whether the user wants an exploratory scan or a CI gate.
- Read the target repository's agent instructions before scanning it.
- Inspect the CodeCrucible repository docs before choosing flags
- Use ./codecrucible from the repository root when the binary exists. Run make build first when working from a fresh checkout.
- Start with a dry run unless the user explicitly asks to execute immediately
- Review the dry-run scope, token estimate, and cost estimate. Narrow with --paths, --include, or --exclude when the scan is broader than…
- Run the real scan with an explicit output path and preserve phase artifacts when analysis or troubleshooting matters
- Verify reported findings in source before presenting them. Distinguish the final audited SARIF from pre-audit analysis artifacts.
What it can do on your machine
Read from SKILL.md and the folder at commit 66156cf. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
make
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
CodeCrucible Security Scans loads about 1.2k tokens when it runs. Until then it costs about 99 tokens; SKILL.md has 456 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from block/codecrucible at commit 66156cf, republished under its Apache-2.0 licence (© block). 456 words, ~1,151 tokens.
Download SKILL.mdSave it as
.claude/skills/codecrucible/SKILL.md (or your agent's skills folder).- name
- codecrucible
- description
- Use CodeCrucible to run, configure, troubleshoot, or interpret LLM-backed security scans and SARIF output. Use when a user asks to scan a repository with codecrucible, choose a provider/model or prompt set, estimate scan cost, inspect phase artifacts, automate a scan, or explain CodeCrucible findings. Do not use for general security review requests that do not involve CodeCrucible.
CodeCrucible
Use CodeCrucible as a cost-aware security scanning CLI. Treat its output as evidence to verify against source, not as a final vulnerability verdict.
Workflow
- Identify the target repository, requested scope, output destination, and whether the user wants an exploratory scan or a CI gate.
- Read the target repository's agent instructions before scanning it.
- Inspect the CodeCrucible repository docs before choosing flags:
- Read
README.mdfor CLI flags, provider setup, config precedence, and built-in supported models. - Read
PROMPT_SETS.mdwhen choosing a prompt set. - Run
./codecrucible list-models --provider <provider>when credentials are configured and provider-reported endpoints matter; do not invent model IDs or provider-specific parameters.
- Read
- Use
./codecruciblefrom the repository root when the binary exists. Runmake buildfirst when working from a fresh checkout. - Start with a dry run unless the user explicitly asks to execute immediately:
./codecrucible scan /path/to/repo --dry-run- Review the dry-run scope, token estimate, and cost estimate. Narrow with
--paths,--include, or--excludewhen the scan is broader than the user's request. - Run the real scan with an explicit output path and preserve phase artifacts when analysis or troubleshooting matters:
./codecrucible scan /path/to/repo \
--output /tmp/codecrucible-results.sarif \
--phase-output-dir /tmp/codecrucible-phases- Verify reported findings in source before presenting them. Distinguish the final audited SARIF from pre-audit analysis artifacts.
Selection Guidance
- Use
prompts/defaultfor general first-pass coverage. - Use the closest
prompts/exploit-proof-*set for language-specific, precision-oriented reviews. - Use
prompts/exploit-prooffor polyglot targets or when no language-specific set fits. - Use
carlini,carlini-curated, ornano-analyzeronly when the user asks for that style or when the constraints described inPROMPT_SETS.mdfit the task. - Prefer cheaper models for feature detection and stronger reasoning models for analysis when cost matters; use per-phase flags instead of forcing one model across every phase.
- Keep
--max-costset for exploratory work. Use--fail-on-severityonly when the user wants a gating exit code.
Show full SKILL.md (159 more words)Show less
Provider And Config Rules
- Keep API keys in environment variables; do not put them in commands, config files committed to git, or responses.
- Respect config precedence: CLI flags override environment variables, which override config files, which override defaults.
- For custom or newly released models, inspect
README.md,internal/config/models.go, and provider documentation before setting context limits, output limits, structured-output flags, or model params. - If a model or provider is unknown to the built-in registry, use explicit
--context-limitand--max-output-tokensrather than assuming defaults are correct.
Reading Results
- The main
--outputfile is the final SARIF result after audit when audit is enabled. *.analysis.sarifis the pre-audit finding set.*.audit.sarifshows the audited result.*.feature-detection.jsonhelps explain why sections were included or pruned.- When a finding disappears between analysis and audit, inspect the audit artifact before concluding the scanner missed it.
- When reporting findings, include file path, line, CWE/rule ID when present, exploitability reasoning, and whether the finding survived audit.
Common Commands
# Query provider-reported models/endpoints when credentials are configured.
./codecrucible list-models --provider anthropic
# General scan with a precision-oriented Go prompt set.
./codecrucible scan /path/to/repo \
--prompts-dir prompts/exploit-proof-web-go \
--output /tmp/codecrucible-results.sarif
# Cost-aware mixed-model scan.
./codecrucible scan /path/to/repo \
--fd-provider google --fd-model gemini-3.5-flash \
--provider anthropic --model claude-opus-4-8 \
--audit-provider anthropic --audit-model claude-sonnet-5 \
--max-cost 25 \
--output /tmp/codecrucible-results.sarif© block, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .agents/skills/codecrucible of block/codecrucible.
Open the folder on GitHubat commit 66156cf
Compare with similar skills
CodeCrucible Security Scans next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| CodeCrucible Security Scans this skillblock/codecrucible | 117 | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | |
| CodeQL Security Scantrailofbits/skills | 7.4k | — | ~4.6k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Pyspector Security AuditParzivalHack/PySpector | 151 | — | ~3.5k | Automated safety check: Notes | Apache-2.0 | |
| Cyber NeoHainrixz/cyber-neo | 281 | — | ~5.9k | Automated safety check: Warn | MIT | |
| CSO Security Auditgarrytan/gstack | 136k | — | ~4.5k | Automated safety check: Pass | MIT | |
| Security ReviewerJeffallan/claude-skills | 12k | — | ~1.3k | Automated safety check: Pass | MIT |
Similar skills
- Official
Pyspector Security Audit
ParzivalHack/PySpector
Run a full Python codebase security audit using PySpector (https://github.com/ParzivalHack/PySpector), a Rust-core SAST scanner.
Cyber Neo
Hainrixz/cyber-neo
Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.
CSO Security Audit
garrytan/gstack
Runs an evidence-first security audit of a codebase through gstack's trusted launcher, with static findings by default and isolated reproduction when enabled.
Security Reviewer
Jeffallan/claude-skills
Audits code and infrastructure for vulnerabilities and produces a severity-rated report with locations and remediation, using SAST, dependency and secrets scans plus manual review.
Configure Repo Scan
harness/harness-skills
Configure code scanning in Harness pipelines using STO security scanners.
Related
Categories
Questions about CodeCrucible Security Scans
What does CodeCrucible Security Scans do?
Runs the codecrucible CLI for LLM-backed security scans of a repository, checks scope and cost first with a dry run, and reads the SARIF results. The agent treats CodeCrucible output as evidence to check against the source, not as a final verdict.md before choosing flags.
When should I use CodeCrucible Security Scans?
CodeCrucible Security Scans fits situations like: scanning a repository with CodeCrucible and reading the SARIF output; estimating the token usage and cost of a scan before running it; choosing a provider, model or prompt set for a scan; explaining CodeCrucible findings or phase artifacts.
How do I install CodeCrucible Security Scans in Claude Code?
Run `npx skills add block/codecrucible --skill codecrucible -a claude-code`. Or copy the skill folder (.agents/skills/codecrucible in block/codecrucible) into .claude/skills/codecrucible in your project. Claude Code loads it when a task matches its description.
How do I install CodeCrucible Security Scans in Codex?
Run `npx skills add block/codecrucible --skill codecrucible -a codex`. Or copy the skill folder (.agents/skills/codecrucible in block/codecrucible) into .agents/skills/codecrucible in your project. Codex loads it when a task matches its description.
Can I use CodeCrucible Security Scans in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add block/codecrucible --skill codecrucible -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/codecrucible, .gemini/skills/codecrucible, .github/skills/codecrucible and .opencode/skills/codecrucible in your project.
What does CodeCrucible Security Scans need to run?
Going by SKILL.md and its folder, CodeCrucible Security Scans needs the command-line tools its instructions call (make). Our summary lists: The codecrucible binary, built with make build; An API key for an LLM provider, held in an environment variable.
Does CodeCrucible Security Scans access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is CodeCrucible Security Scans safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does CodeCrucible Security Scans use?
CodeCrucible Security Scans is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does CodeCrucible Security Scans use?
About 1.2k tokens (SKILL.md is roughly 4.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to CodeCrucible Security Scans?
Skills that share tags, products or a category with CodeCrucible Security Scans: CodeQL Security Scan (trailofbits/skills, 7.4k stars), Pyspector Security Audit (ParzivalHack/PySpector, 151 stars), Cyber Neo (Hainrixz/cyber-neo, 281 stars) and CSO Security Audit (garrytan/gstack, 136k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains CodeCrucible Security Scans?
block (a GitHub organization, an official publisher) maintains it in block/codecrucible, which has 117 GitHub stars. The repository was last updated on October 7, 2026.
Source: block/codecrucible on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.