Li_codeql_LLM

What This Skill Does

Li_codeql_LLM is a sophisticated security-focused automation tool designed to bridge the gap between static application security testing (SAST) and intelligent vulnerability remediation. It orchestrates the entire CodeQL pipeline—from environment validation and database creation to complex analysis. By integrating with LLMs, the skill goes beyond traditional scanner output; it parses intricate SARIF data to filter out false positives, rank vulnerabilities by actual business risk, and provide actionable, context-aware remediation advice. It outputs both a structured security report and a step-by-step verification checklist, streamlining the devsecops workflow for developers and security analysts alike.

Installation

To integrate this tool into your OpenClaw environment, ensure you have the necessary system dependencies installed including CodeQL CLI (v2.10.0+), Python 3.11+, and your choice of uv or pip. Execute the following command within your terminal or OpenClaw interface: clawhub install openclaw/skills/skills/43622283/li-codeql-llm. Ensure that your environment has appropriate read/write permissions for the directory being analyzed and that your system PATH is configured to recognize the codeql binary.

Use Cases

• Automated Security Audits: Regularly run scans against source code repositories to catch vulnerabilities before they reach production.
• CI/CD Integration: Seamlessly incorporate the skill into automated pipelines to gate deployments based on security severity thresholds.
• Targeted Penetration Testing: Use the skill to scan vulnerable machines or legacy projects to generate a precise attack surface map and a validation checklist for manual verification.
• Remediation Planning: Leverage LLM insights to prioritize the most critical bugs based on code context rather than just raw scanner scores.

Example Prompts

1. "Scan the project located at /home/user/workspace/web-app and generate a vulnerability verification checklist."
2. "Perform a security audit on /var/www/legacy-site, categorize findings by OWASP Top 10, and explain the top 3 risks."
3. "Analyze the current directory for high-severity Python vulnerabilities and draft a report with specific code-level remediation suggestions."

Tips & Limitations

• False Positives: While the LLM layer significantly improves accuracy, always manually verify high-risk findings before taking destructive action.
• Resource Management: Large codebases require significant memory and CPU for the database creation phase; ensure adequate system resources before scanning massive repositories.
• Language Support: Ensure your project languages align with the supported QL libraries. Always keep your local CodeQL query packs updated to benefit from the latest security research.