---
title: "CodeQL Code Scanning - Air Market"
description: "You want automatic security checks running on your code, and the setup involves workflow files and command-line flags you would rather not learn from scratch. This walks you through configuring CodeQ…"
canonical: "https://airmarket.ai/app/codeql"
---

[Air Market](/) / [Security](/category/security) / CodeQL Code Scanning

Skill by [GitHub](/@github)

# CodeQL Code Scanning

Get code scanning configured without guessing at the workflow file

## What this does

You want automatic security checks running on your code, and the setup involves workflow files and command-line flags you would rather not learn from scratch. This walks you through configuring CodeQL scanning, either through GitHub Actions or the CLI. Reach for it when you are setting it up for the first time, or when a scan you already had is misbehaving.

### Top 3 things it does for you

- Set up code scanning on this repo
- Fix a workflow file that will not run
- Work out why an analysis is failing

## Information

**CodeQL Code Scanning at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [GitHub](/@github) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 64 KB |
| Licence | MIT |
| Repository | [github/awesome-copilot](https://github.com/github/awesome-copilot/tree/90921cc46f4e452ea379e70884d60ec25263f16a/skills/codeql) |
| GitHub stars | 38,187 (as of Nov 2026) |
| Installs | 1,987, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of CodeQL Code Scanning and flagged nothing. AIR's verdict: **safe**.

**What CodeQL Code Scanning's check was run against**

|  |  |
| --- | --- |
| Commit | 90921cc46f4e452ea379e70884d60ec25263f16a |
| Content hash | 190d5c522cdd2bff926d7d2166c18f72feb5c2fb1b55ebbc87a8a2425df2eedf |
| Files read | [Browse the files at this exact commit](https://github.com/github/awesome-copilot/blob/90921cc46f4e452ea379e70884d60ec25263f16a/skills/codeql/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for CodeQL Code Scanning](/security/codeql)

## About CodeQL Code Scanning

A guide to setting up and configuring CodeQL code scanning, both through GitHub Actions workflows and through the CodeQL CLI.

Use it when you need help with code scanning configuration, CodeQL workflow files, CLI commands, SARIF output, or getting security analysis set up in the first place. It also covers troubleshooting when a CodeQL analysis is not behaving.

## What's inside

- SKILL.md - instructions
- references/alert-management.md - reference
- references/cli-commands.md - reference
- references/compiled-languages.md - reference
- references/sarif-output.md - reference
- references/troubleshooting.md - reference
- references/workflow-configuration.md - reference

## Questions

### Is CodeQL Code Scanning safe to install?

AIR scanned this exact version of CodeQL Code Scanning and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 90921cc46f4e, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/codeql.

### How do I install CodeQL Code Scanning?

Open https://airmarket.ai/app/codeql on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/github/awesome-copilot/tree/90921cc46f4e452ea379e70884d60ec25263f16a/skills/codeql. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by GitHub](/@github)

---

Canonical URL: <https://airmarket.ai/app/codeql>