Trailmark Finding Triage
Performs graph-assisted triage of a single security finding, SARIF result, weAudit...
Install
npx skills add trailofbits/skills --skill trailmark-finding-triage -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Security
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Mediumabout 1,804 tokens
- Runs scripts
- Yes, review before use
What it does
Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.
Trailmark Finding Triage
Build a concise graph evidence packet for one candidate finding. This skill answers whether the affected code is reachable, what graph evidence supports or weakens the claim, and what manual review is still required before calling the issue exploitable.
When to Use
- Triage one static-analysis result before spending PoC time
- Check whether a manual finding is entrypoint-reachable
- Build an evidence packet for PoC work
- Review a single suspicious function discovered during manual audit
- Decide whether one issue should be promoted, deprioritized, or treated as part of a broader chain analysis
When NOT to Use
- Multiple weak findings might compose into a stronger chain. Use a chain or composition workflow instead.
- The user wants a full audit. Use an audit or design-review workflow instead.
- The user wants remediation verification for a known finding. Use a remediation-review workflow instead.
- The target is a PR or branch diff. Use
graph-evolutionplus a differential review workflow. - No concrete finding, function, file/line, or suspicious sink exists yet. Use discovery skills first.
