audit-augmentation

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, sarif, security, trailmark.

What it does

Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill audit-augmentation

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/audit-augmentation ~/.claude/skills/audit-augmentation

Safety box score

Grade B, low risk: 18 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill overlays SARIF, weAudit, and optional binary-analysis JSON onto a local Trailmark graph. The main risks are a package install from the network and automatic ingestion of untrusted audit files that mutate local analysis state and influence downstream triage.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It relies on running local commands and Python snippets such as `uv run trailmark augment {targetDir} --sarif results.sarif` and `QueryEngine.from_directory(...)`, but only for bounded Trailmark analysis.
Network access	2 (moderate)	The installation path `uv tool install trailmark` fetches code and dependencies from a package registry, which is a real network download even though the skill does not describe any runtime remote API calls.
Filesystem reach	1 (low)	It reads local workspace inputs like `results.sarif` and `.vscode/<username>.weaudit` and writes Trailmark annotations/subgraphs in the project context; it does not describe system-wide or destructive file access.
Secrets & credentials	0 (none)	The skill does not ask for tokens, passwords, key files, browser sessions, or `.env` contents.
Privilege & persistence	0 (none)	There is no sudo, service registration, shell startup editing, or global OS change; `uv tool install trailmark` is a user-local install.
Instruction hijack surface	0 (none)	The text contains workflow guidance and a version gate, but no instruction to ignore higher-priority rules, hide actions, or follow remote prompts.
Irreversible actions	1 (low)	It automatically imports findings and creates annotations/subgraphs (`engine.augment_sarif()`, `engine.augment_weaudit()`, `engine.augment_binary()`), which changes local triage state but does not publish or delete anything externally.
Transparency	0 (none)	All shipped files are plain text documentation/config/SVG; there are no binaries, obfuscated blobs, or unreviewable installers.

Before installing

Confirm you trust the package source for `uv tool install trailmark`.
Inspect any SARIF/weAudit inputs for secrets and unexpected absolute or `file://` paths before importing them.
Test augmentation on a scratch clone first, since it creates annotations and subgraphs in Trailmark state.
Verify your Trailmark version before using binary import; `augment_binary()` is only for 0.4.0+.

Rated 2026-10-19 by an automated review of 4 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/trailmark/skills/audit-augmentation/SKILL.md
Branch: main
Collection: trailmark
Updated: 2026-09-19

graph-evolution — Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes.
trailmark — Builds and queries multi-language source and binary code graphs for security analysis.
trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
trailmark-review-gate — Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths.
trailmark-structural — Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries.
trailmark-variant-neighborhood — Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions.