trailmark-variant-neighborhood
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
npx skills add trailofbits/skills --skill trailmark-variant-neighborhood --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Trailmark Variant Neighborhood Expand one seed issue into graph-derived variant candidates. This skill generates review targets, not confirmed findings. ## When to Use - A finding is confirmed or plausible and variants may exist - The vulnerable pattern depends on call context - The issue involves a shared sink, source, validator, interface, override, trait, hook, handler, adapter, or critical type - The next step is to seed `variant-analysis`, `semgrep-rule-creator`, `static-analysis`, or manual review ## When NOT to Use - No seed issue exists. Use discovery or triage first. - The pattern is purely syntactic and already obvious. Use `semgrep-rule-creator` directly. - The question is exploit-chain composition across multiple findings. Use a composition workflow. - The goal is remediation verification. Use a remediation-review workflow. - The seed cannot be bound to a graph node. ## Rationalizations to Reject | Rationalization | Why It Is Wrong | Required Action | |---|---|---| | "Nearby code means variant" | Proximity is only a candidate reason | Rank it as a review target | | "Only exact same names matter" | Variants often share sinks or preconditions, not names | Expand across
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Workflow
- Step 1: Normalize And Bind The Seed
- Step 2: Expand Neighborhoods
- Step 3: Rank Candidates
- Step 4: Extract Pattern Guidance
- Step 5: Emit Handoff Packet
- Stop Conditions
What does the trailmark-variant-neighborhood skill do?
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
How do I install it?
Run `npx skills add trailofbits/skills --skill trailmark-variant-neighborhood --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.