audit-augmentation
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings
npx skills add trailofbits/skills --skill audit-augmentation --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Audit Augmentation Projects findings from external tools (SARIF) and human auditors (weAudit) onto Trailmark code graphs as annotations and subgraphs. Trailmark 0.4.0+ can also import an external binary-analysis graph JSON export via `engine.augment_binary()`. ## When to Use - Importing Semgrep, CodeQL, or other SARIF-producing tool results into a graph - Importing weAudit audit annotations into a graph - Importing binary-analysis graph data into a source graph (Trailmark 0.4.0+) - Cross-referencing static analysis findings with blast radius or taint data - Querying which functions have high-severity findings - Visualizing audit coverage alongside code structure - Preparing one SARIF or weAudit result for `trailmark-finding-triage` ## When NOT to Use - Running static analysis tools (use semgrep/codeql directly, then import) - Building the code graph itself (use the `trailmark` skill) - Generating diagrams (use the `diagramming-code` skill after augmenting) ## Rationalizations to Reject | Rationalization | Why It's Wrong | Required Action | |-----------------|----------------|-----------------| | "The user only asked about SARIF, skip pre-analysis" | Without pre-analysis, you can'
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Installation
- Version Gate
- Quick Start
- CLI
- Programmatic API
- Workflow
- Annotation Format
- Subgraphs Created
- How Matching Works
- Supporting Documentation
uv pip install trailmark
Augment with SARIF
uv run trailmark augment {targetDir} --sarif results.sarif
Augment with weAudit
uv run trailmark augment {targetDir} --weaudit .vscode/alice.weaudit
Both at once, output JSON
uv run trailmark augment {targetDir} \What does the audit-augmentation skill do?
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings
How do I install it?
Run `npx skills add trailofbits/skills --skill audit-augmentation --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.