trailofbits-codeql — agentic threat model

Not certain from the listing — relies on an underlying foundation model for CodeQL query generation. Primary threats include prompt injection leading to the generation of malicious or intentionally flawed queries that bypass security checks, or model reprogramming to hide vulnerabilities.

The agent interacts with target codebases and bundled reference materials. Threats include codebase poisoning where malicious code is structured to exploit the static analysis engine, or unauthorized exfiltration of proprietary source code via query results.

The agent orchestrates CodeQL execution as its script surface. A major threat is insecure tool integration, where a crafted prompt or malicious codebase tricks the agent into executing arbitrary system commands or unauthorized CodeQL commands.

Not certain from the listing — the execution environment for CodeQL is critical. If the host environment lacks strict containerization or sandboxing, running CodeQL against untrusted codebases could lead to host compromise or lateral network movement.

Not certain from the listing — requires robust logging of executed queries and generated outputs to detect evasion attempts or malicious query patterns. Lack of observability could allow silent bypasses of security scans.

Not certain from the listing — requires strict access controls to ensure only authorized users can run queries against sensitive codebases, and policy enforcement to prevent the tool from being used for unauthorized vulnerability research on external systems.

The agent is part of the building-secure-contracts/static-analysis plugin ecosystem. Threats include cascading failures if upstream orchestration agents pass untrusted inputs, or trust abuse where other agents blindly trust this agent's vulnerability reports.