# Trailmark Finding Triage

Performs graph-assisted triage of a single security finding, SARIF result, weAudit...

- Repository: https://github.com/trailofbits/skills (7935 stars)
- Category: Security
- License: CC-BY-SA-4.0
- Last updated: 2026-10-28
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add trailofbits/skills --skill trailmark-finding-triage -g -a claude-code -y`
Codex: `npx skills add trailofbits/skills --skill trailmark-finding-triage -g -a codex -y`
Cursor: `npx skills add trailofbits/skills --skill trailmark-finding-triage -g -a cursor -y`
Gemini CLI: `npx skills add trailofbits/skills --skill trailmark-finding-triage -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add trailofbits/skills`

## Description

Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Trailmark Finding Triage

Build a concise graph evidence packet for one candidate finding. This skill
answers whether the affected code is reachable, what graph evidence supports
or weakens the claim, and what manual review is still required before calling
the issue exploitable.

## When to Use

- Triage one static-analysis result before spending PoC time
- Check whether a manual finding is entrypoint-reachable
- Build an evidence packet for PoC work
- Review a single suspicious function discovered during manual audit
- Decide whether one issue should be promoted, deprioritized, or treated as
  part of a broader chain analysis

## When NOT to Use

- Multiple weak findings might compose into a stronger chain. Use a chain or
  composition workflow instead.
- The user wants a full audit. Use an audit or design-review workflow instead.
- The user wants remediation verification for a known finding. Use a
  remediation-review workflow instead.
- The target is a PR or branch diff. Use `graph-evolution` plus a differential
  review workflow.
- No concrete finding, function, file/line, or suspicious sink exists yet. Use
  discovery skills first.

## Rationalizations to Reject

The rest: https://github.com/trailofbits/skills/blob/HEAD/plugins/trailmark/skills/trailmark-finding-triage/SKILL.md