trailmark-finding-triage
Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.
npx skills add trailofbits/skills --skill trailmark-finding-triage --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Trailmark Finding Triage Build a concise graph evidence packet for one candidate finding. This skill answers whether the affected code is reachable, what graph evidence supports or weakens the claim, and what manual review is still required before calling the issue exploitable. ## When to Use - Triage one static-analysis result before spending PoC time - Check whether a manual finding is entrypoint-reachable - Build an evidence packet for PoC work - Review a single suspicious function discovered during manual audit - Decide whether one issue should be promoted, deprioritized, or treated as part of a broader chain analysis ## When NOT to Use - Multiple weak findings might compose into a stronger chain. Use a chain or composition workflow instead. - The user wants a full audit. Use an audit or design-review workflow instead. - The user wants remediation verification for a known finding. Use a remediation-review workflow instead. - The target is a PR or branch diff. Use `graph-evolution` plus a differential review workflow. - No concrete finding, function, file/line, or suspicious sink exists yet. Use discovery skills first. ## Rationalizations to Reject | Rationalization | Why It I
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Workflow
- Step 1: Normalize the Candidate
- Step 2: Build Or Reuse The Graph
- Step 3: Bind The Candidate
- Step 4: Analyze Graph Evidence
- Step 5: Decide And Handoff
- Example Prompts
What does the trailmark-finding-triage skill do?
Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.
How do I install it?
Run `npx skills add trailofbits/skills --skill trailmark-finding-triage --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.