CodeQL 本地告警因果定位与修复验收

• Outcome: Pass
• Latest audit: Sep 24, 2026 · 4:50 PM UTC
• Version: 1.0.0

Overview

This is a disclosed local CodeQL triage helper with expected local source analysis and optional CodeQL execution, not hidden or malicious behavior.

Install only if you are comfortable with a local tool reading and copying the source tree you point it at, writing temporary analysis artifacts, and optionally running CodeQL or downloading CodeQL components from GitHub. Use a narrow --tree and explicit --workdir for sensitive repositories, and verify the CodeQL binary/source in controlled environments.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied code only parses existing SARIF output and reports sinks and code-flow paths. That supports part of the declared workflow—understanding why CodeQL flagged something by revealing source-to-sink flow—but it falls well short of the broader declared purpose. There is no logic for variant bisection, no mechanism to compare code variants, no determination of the exact line that must change for an alert to disappear, no false-positive adjudication, and no fix validation beyond counting SARIF results if a file is already provided. The script’s actual primary purpose is SARIF inspection/reporting, with optional machine-readable output and CI-style result-count assertion. Therefore the description materially overstates the behavior and primary capability of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is substantial overlap in topic area—both concern CodeQL-sensitive-source reasoning for Python security queries—but the implemented code is materially narrower and different in primary purpose. The description promises an interactive alert-triage capability: explain why CodeQL reported a particular alert, confirm taint sources, locally validate fixes, and decide false positive vs real vulnerability for single CodeQL findings. In contrast, the script merely reimplements name-based source heuristics for Python and lists candidate source sites without building a CodeQL database. It never consumes a CodeQL result, query, SARIF, or code flow, and it cannot establish whether a particular reported alert is caused by a given source-sink path or whether changing a particular line would suppress that alert. This is not just an implementation detail; it is a materially different behavior profile: a heuristic pre-scan utility rather than a causal alert explanation/validation tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is for an auditor/assistant skill that reasons about CodeQL findings: explaining why an alert fired, confirming taint sources, reproducing alert causality, and deciding whether an alert is a false positive. The supplied code chunk does not implement that analytical behavior. Instead, it is a minimal Python repro fixture that searches a hardcoded string for literal secret-pattern substrings and writes JSON to disk. While the docstring mentions CodeQL false positives, the actual code is just test data / a repro sample, not a tool or skill that performs CodeQL alert explanation or validation. That makes the primary purpose materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose is a CodeQL alert explanation/triage capability: determine causality for a CodeQL finding, confirm taint sources, assess false positives, and identify the specific line change needed to remove an alert. The actual code is just a minimal Python example that runs locally, compares a constant string against two credential-like patterns using substring checks, and writes the result to report.json. There is no CodeQL integration, no scan result parsing, no dataflow/taint reasoning, no alert validation logic, and no mechanism for explaining or bisecting a CodeQL warning. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly says 'All CLI messages are Chinese' while presenting JSON as the locale-independent workaround. This is a natural-language language-policy constraint that forces a specific language for interactive output rather than offering the user a choice or opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says to use the skill when the user says phrases like "为什么 CodeQL 报这个" and "这个告警是不是误报", which are broad natural-language requests rather than narrowly scoped invocation triggers. Without explicit exclusion conditions or a constrained activation context, these phrases could match ordinary troubleshooting conversation and cause unintended skill invocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/running-codeql-cli.md (reported line 43)May include surrounding context.

只跑目标那一条，别跑整个 suite（python-code-scanning.qls 要几十分钟）。

bash

codeql database create  "$T/db" --language=python --source-root="$SRC" --overwrite --threads=0
codeql database analyze "$T/db" --download --format=sarif-latest \
    --output="$T/out.sarif" --threads=0 \
    "codeql/python-queries:Security/CWE-312/CleartextStorage.ql"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bisect_taint.py (reported line 66)May include surrounding context.

python

def _run(cmd: list[str]) -> int:
    print("  $ " + " ".join(f'"{c}"' if " " in c else c for c in cmd), flush=True)
    return subprocess.call(cmd)


def _stage(tree: Path, src_rel: Path, dst: Path, body: str | None,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/run_tests.py (reported line 47)May include surrounding context.

python

def _run(script: Path, *args: str) -> subprocess.CompletedProcess:
    return subprocess.run([sys.executable, str(script), *args],
                          capture_output=True, text=True, encoding="utf-8")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file instructs the user to download the CodeQL CLI and notes that query packs are pulled automatically during database analyze. Because the file describes network retrieval of external binaries and packages, a brief user-facing warning about internet access and fetching third-party content would improve transparency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains multiple user-visible strings such as status messages, errors, and summaries in Chinese, while the skill does not provide any option to select language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This Python file contains extensive bilingual user-facing natural language in its module docstring and CLI help text, but it does not explicitly let the user opt into a preferred language. Under the policy category, forcing or assuming a locale without user choice can be considered a natural-language policy issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 53% confidence

Finding

This file is JSON, so vague-trigger review applies. The natural-language descriptors are broad and lack specificity about when they apply or do not apply, which can create ambiguity if this metadata is used to describe invocation or activation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code file contains natural-language documentation saying the printed assertion labels are Chinese, which indicates a fixed language choice for user-visible output. The policy allows locale constraints when users are given a choice or when the constraint is clearly justified; here no user opt-in or alternative language is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.