What are the best alternatives to codeql?
The highest-scoring alternative to codeql is skill-scanner from getsentry/skills, at 88/100 (grade B) on the Suede Skill Check; codeql scores 92/100. The table compares 7 security audit skills in security from other publishers, each with a full SuedeAI.directory page. Every score follows the published rubric.
codeql and 7 alternatives
Alternatives share codeql's category and task, come from other publishers and each have a full directory page. Ranked by Suede Skill Check score.
| Skill | Publisher | Suede Skill Check | License | What it does |
|---|---|---|---|---|
| codeql Compared skill | Trail of Bits Official trailofbits/skills | 92/100 · A | CC-BY-SA-4.0 | Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with run-all and important-only scan modes. |
| skill-scanner | Sentry Official getsentry/skills | 88/100 · B | Apache-2.0 | Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation. |
| gha-security-review | Sentry Official getsentry/skills | 86/100 · B | Apache-2.0 | Reviews GitHub Actions workflows for exploitation vulnerabilities such as pwn requests, expression injection, credential theft, and supply chain attacks, with concrete proof-of-concept scenarios. |
| security-review | Sentry Official getsentry/skills | 86/100 · B | CC-BY-SA-4.0 | Reviews code for security vulnerabilities including injection, XSS, authentication, authorization, and cryptography issues, using a systematic process with confidence-based reporting. |
| aig-scanner | Tencent Tencent/AI-Infra-Guard | 82/100 · B | MIT | Runs AI security scans of infrastructure, AI tools and skills, and AI agents, and evaluates LLM jailbreak resistance with Tencent's AI-Infra-Guard. |
| firebase-security-rules-auditor | Firebase Official firebase/skills | 78/100 · C | Apache-2.0 | Audits Firebase Firestore and Cloud Storage security rules for vulnerabilities including privilege escalation, role bypasses, and resource exhaustion. |
| redis-security | Redis Official redis/agent-skills | 75/100 · C | MIT | Guides Redis security, covering authentication with requirepass and ACL users, TLS, least-privilege access control, network exposure limits, and disabling dangerous commands. |
| security-audit | Cloudflare Official cloudflare/security-audit-skill | 72/100 · C | MIT | Provides security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons, including focused reviews, vulnerability research, audits, and pen tests. |
Questions and answers
What is the highest-scoring alternative to codeql?
skill-scanner from getsentry/skills, at 88/100, grade B. It earns full points for structural checks, recent maintenance and instruction depth. Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation.
How does codeql compare with its alternatives?
codeql scores 92/100, grade A. Of the 7 alternatives, 7 score lower; their scores run from 72 to 88. All of them sit in security and match the security audits keyword map.
Are the alternatives to codeql free?
All 7 alternatives to codeql are published in public GitHub repositories and cost nothing to download. Every one uses an open-source or open-content license, led by Apache-2.0 (3), MIT (3) and CC-BY-SA-4.0 (1), so you can use and adapt the files at no cost under those terms. 2 skills name credentials for an outside service; each full page lists them under Before you install.
Do the alternatives to codeql work in Claude Code, Codex and Cursor?
Yes. Each of the 7 alternatives to codeql is a SKILL.md folder in the Agent Skills format, which Claude Code, Codex and Cursor all read. The skills CLI (npx skills add) installs every one of them into Claude Code, Codex, Cursor and other agents, and each full skill page adds a project-level copy into .claude/skills for Claude Code and .agents/skills for Codex.