Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.
$ npx skills add netdata/netdata --skill triage-codeql -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install netdata/netdata triage-codeql --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/netdata/netdata.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/triage-codeql .claude/skills/triage-codeql && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "triage-codeql" agent skill from https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeql into .claude/skills/triage-codeql/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-codeql", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeqlType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add netdata/netdata --skill triage-codeql -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install netdata/netdata triage-codeql --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/netdata/netdata.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.agents/skills/triage-codeql .agents/skills/triage-codeql && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "triage-codeql" agent skill from https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeql into .agents/skills/triage-codeql/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-codeql", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add netdata/netdata --skill triage-codeql -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install netdata/netdata triage-codeql --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/netdata/netdata.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.agents/skills/triage-codeql .cursor/skills/triage-codeql && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "triage-codeql" agent skill from https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeql into .cursor/skills/triage-codeql/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-codeql", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/netdata/netdata.git --path .agents/skills/triage-codeql--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add netdata/netdata --skill triage-codeql -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install netdata/netdata triage-codeql --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/netdata/netdata.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.agents/skills/triage-codeql .gemini/skills/triage-codeql && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "triage-codeql" agent skill from https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeql into .gemini/skills/triage-codeql/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-codeql", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install netdata/netdata triage-codeqlInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add netdata/netdata --skill triage-codeql -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/netdata/netdata.git skills-src && mkdir -p .github/skills && cp -r skills-src/.agents/skills/triage-codeql .github/skills/triage-codeql && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "triage-codeql" agent skill from https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeql into .github/skills/triage-codeql/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-codeql", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add netdata/netdata --skill triage-codeql -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install netdata/netdata triage-codeql --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/netdata/netdata.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.agents/skills/triage-codeql .opencode/skills/triage-codeql && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "triage-codeql" agent skill from https://github.com/netdata/netdata/tree/master/.agents/skills/triage-codeql into .opencode/skills/triage-codeql/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "triage-codeql", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
triage-codeqlInspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.
Triage Codeql is an agent skill from netdata/netdata. Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized. Not for CodeQL query authoring, CI configuration, Dependabot, or secret scanning.
Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts (for example `scripts/_lib.sh`, `scripts/codeql-dismiss.sh` and `scripts/codeql-list.sh`).
It sits in Security, covering Static analysis and SAST, Secrets management and Dependency management. It works with GitHub. The repository describes itself as: The fastest path to AI-powered full stack observability, even for lean teams. The licence is GPL-3.0.
Read from SKILL.md and the folder at commit 9fe30d9. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 3 files in scripts/ (Shell and Python), which the agent can run.
Shell commands in SKILL.md call:
bashghjqFrom the folder's file list and the shell code blocks in SKILL.md.
Links to these hosts (documentation or services it may open):
docs.github.comcli.github.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Triage Codeql loads about 1.8k tokens when it runs. Until then it costs about 55 tokens; SKILL.md has 785 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check noted patterns worth knowing about, such as sudo or a known installer.
The helpers do not source `.env`. Use `gh auth status` to diagnose missing authentication; use `gh auth login`Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
The full file from netdata/netdata at commit 9fe30d9, republished under its GPL-3.0 licence (© netdata). 785 words, ~1,767 tokens.
.claude/skills/triage-codeql/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.Use the shipped helpers for GitHub REST alert operations. Run commands below from the repository root.
Owner references starting with ./ are relative to this skill directory.
| Task | Read |
|---|---|
| List, inspect or review findings | Setup, Inspect, Triage Decisions |
| Apply an authorized dismissal or batch | Setup, Inspect, Triage Decisions, Apply Verified Decisions |
| Diagnose a failed request | Troubleshooting and the linked API/CLI reference |
| Change queries, suites or CI | The workflow and config owners below; this is not an operational triage task |
Authorization and read-only scope follow AGENTS.md#when-a-sow-is-required; findings and evidence follow
AGENTS.md#review. Inspection stops at the verified report. Applying remote state changes requires authorization
covering those actions; preserve permission already granted for the current scope.
./scripts/codeql-list.sh, ./scripts/codeql-dismiss.sh, and ./scripts/_lib.sh own their arguments,
output and repository resolution. Use list-helper --help for its flags..github/workflows/codeql.yml and its referenced .github/codeql/ configs.
Do not infer every language uses the C/C++ security-extended configuration.AGENTS.md#knowledge-capture.gh and jq; summary output also uses awk, sort, head and column.gh, through its configured credentials or supported exported environment variables.
The helpers do not source .env. Use gh auth status to diagnose missing authentication; use gh auth login
only when setup is needed. Do not request credential values in conversation.upstream, falling back to origin when that remote lookup is absent.
They are intended for github.com remotes; a fork checkout can therefore operate on upstream alerts.Resolve the same target used by both helpers; this reads Git configuration without displaying the remote URL.
Keep Setup and subsequent examples in the same shell session so they share codeql_repo:
source .agents/skills/triage-codeql/scripts/_lib.sh
codeql_repo="$(gh_require_slug)"
printf '%s\n' "$codeql_repo"The default is open alerts across tools. The compact summary shows only the most frequent rule/severity groups;
use --raw for the complete array merged across pages. For a CodeQL-only investigation:
bash .agents/skills/triage-codeql/scripts/codeql-list.sh --tool=CodeQL
bash .agents/skills/triage-codeql/scripts/codeql-list.sh --tool=CodeQL --raw \
| jq -r '.[] | [.number, .rule.id, .most_recent_instance.location.path, .html_url] | @tsv'The list helper also supports --state= and --severity=; choose filters from the requested investigation.
A candidate list is not a dismissal list.
Set codeql_alert to a listed alert number, then inspect the alert with the target resolved in Setup:
gh api "/repos/${codeql_repo:?resolve the repository in Setup}/code-scanning/alerts/${codeql_alert:?set the alert number}"Open the returned html_url for available traces. Verify the rule, affected code, reachability and relevant instances
before deciding; a matching rule ID, directory or filename alone does not establish a false positive.
The dismissal helper supports the following reasons; this is its supported subset, not the complete GitHub API enum.
| Helper reason | Evidence needed |
|---|---|
false positive | The reported defect is incorrect: establish the relevant guard, type or unreachable path. |
won't fix | The defect is real and the user accepts leaving the risk unresolved. |
used in tests | The flagged path is confined to test code or fixtures, rather than reachable production behavior. |
Fixing code and having analysis report fixed is different from dismissing a finding. Reopening a dismissed alert is
also possible through GitHub or the update endpoint with state=open; the dismissal helper does not implement it.
Consult GitHub's alert history when investigating a reopened finding.
Use ./scripts/codeql-dismiss.sh only for the verified alert number, reason and comment covered by authorization.
Set codeql_reason and codeql_comment from that decision. Comments SHOULD be short, factual and ASCII;
the helper passes the quoted comment as one API string argument.
bash .agents/skills/triage-codeql/scripts/codeql-dismiss.sh \
"${codeql_alert:?set the verified alert number}" \
"${codeql_reason:?set the verified reason}" \
"${codeql_comment:?set the supporting explanation}"For a batch, you MUST record the exact verified alert numbers with their reasons and supporting evidence before applying the single-alert helper to each. You MUST NOT pipe a rule-only search directly into dismissal commands. Re-check the target and decision if the code or alert has changed since inspection; inspect the returned state after each request.
Apply writes sequentially and stop on errors. Handle throttling according to the response and GitHub's rate-limit guidance; there is no fixed safe request rate, and the helpers do not implement retries.
| Symptom | Check |
|---|---|
| Missing executable | Install the missing Setup dependency through the environment's normal setup. |
| Authentication or access error | Check gh authentication, endpoint token permissions and repository access. |
| Alert endpoint returns 404 | Confirm resolved repository, alert number, visibility/access and Code Scanning availability. |
| Empty successful output | Inspect --raw, the selected tool/state/severity and the command's exit status. |
| Suspected missing pages | The list helper already uses --paginate; inspect raw output rather than the bounded summary. |
Missing C/C++ findings under build/ | Inspect the workflow's SARIF upload filter; config paths-ignore alone does not explain built analysis. |
For direct calls beyond the helpers, use the linked REST reference and
gh api manual.
Dependabot's GraphQL vulnerabilityAlerts is a different data source; it does not retrieve CodeQL findings.
© netdata, GPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 4 other files (scripts) in .agents/skills/triage-codeql of netdata/netdata.
Open the folder on GitHubat commit 9fe30d9
Triage Codeql next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Triage Codeql this skillnetdata/netdata | 81k | — | ~1.8k | Automated safety check: Notes | GPL-3.0 | |
| Implementing GitHub Advanced Security For Code Scanningmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.3k | Automated safety check: Pass | Apache-2.0 | |
| Triaging Security Findingsbitwarden/ai-plugins | 154 | — | ~2.2k | Automated safety check: Pass | Custom licence | |
| Sicurezza GitHubccplugins/awesome-claude-code-plugins | 967 | — | ~486 | Automated safety check: Notes | Apache-2.0 | |
| Security Vulnerabilities Patcheraxelixlabs/axelix | 147 | — | ~4.2k | Automated safety check: Pass | LGPL-3.0 | |
| Security Remediatecloudposse/atmos | 1.4k | — | ~1.3k | Automated safety check: Pass | Apache-2.0 |
mukul975/Anthropic-Cybersecurity-Skills
Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across…
bitwarden/ai-plugins
This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work…
ccplugins/awesome-claude-code-plugins
Aggiunge alle repository GitHub dei siti workflow di sicurezza automatici - scansione dipendenze vulnerabili, ricerca di segreti/chiavi nel codice, analisi statica CodeQL e Dependabot.
axelixlabs/axelix
Create batched Dependabot-style pull requests for GitHub security findings in axelixlabs/axelix, grouped by dependency surface such as master/front-end, master/build.gradle.kts, or starter Gradle…
cloudposse/atmos
Fix open Dependabot and CodeQL/code-scanning alerts directly on the current branch.
secondsky/claude-skills
GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL).
netdata/netdata
Use only when the user explicitly asks to build, run, preview, inspect, or validate learn.netdata.cloud locally using the contents of a PR or documentation branch before merge.
netdata/netdata
Inspect Netdata-org source checkouts under NETDATAREPOSDIR, or set up and synchronize that mirror when requested.
netdata/netdata
Investigate Netdata crashes, panics and fatals from agent-events captures or authorized fleet queries.
netdata/netdata
Inspect, analyze, troubleshoot, or review Codacy findings and local analyzer/API helpers.
netdata/netdata
Inspect or review Coverity Scan defects and saved CID bundles; fetch live findings or apply verified triage decisions when requested.
netdata/netdata
Inspect, review, or apply authorized triage decisions to SonarCloud issues and security hotspots; also review the Sonar helpers.
Works with
Categories
Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized. Triage Codeql is an agent skill from netdata/netdata. Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.
Triage Codeql fits situations like: tasks that involve Static analysis and SAST; tasks that involve Secrets management; tasks that involve Dependency management.
Run `npx skills add netdata/netdata --skill triage-codeql -a claude-code`. Or copy the skill folder (.agents/skills/triage-codeql in netdata/netdata) into .claude/skills/triage-codeql in your project. Claude Code loads it when a task matches its description.
Run `npx skills add netdata/netdata --skill triage-codeql -a codex`. Or copy the skill folder (.agents/skills/triage-codeql in netdata/netdata) into .agents/skills/triage-codeql in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add netdata/netdata --skill triage-codeql -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triage-codeql, .gemini/skills/triage-codeql, .github/skills/triage-codeql and .opencode/skills/triage-codeql in your project.
Going by SKILL.md and its folder, Triage Codeql needs a shell and Python for the scripts in its folder and the command-line tools its instructions call (bash, gh and jq). Our summary lists: Python 3; A Bash shell.
SKILL.md names 2 domains. As links in the text: docs.github.com and cli.github.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
Triage Codeql is published under the GPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.8k tokens (SKILL.md is roughly 7.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Triage Codeql: Implementing GitHub Advanced Security For Code Scanning (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Triaging Security Findings (bitwarden/ai-plugins, 154 stars), Sicurezza GitHub (ccplugins/awesome-claude-code-plugins, 967 stars) and Security Vulnerabilities Patcher (axelixlabs/axelix, 147 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
netdata (a GitHub organization) maintains it in netdata/netdata, which has 80,820 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on October 7, 2026.
Source: netdata/netdata on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
