graph-evolution

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, security, trailmark, version-control.

What it does

Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill graph-evolution

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/graph-evolution ~/.claude/skills/graph-evolution

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

trailofbits/skills (all skills from this repository)

Path

plugins/trailmark/skills/graph-evolution/SKILL.md

Branch

main

Collection

trailmark

Updated

2026-09-19

Related skills

• audit-augmentation — x binary-analysis graph exports. ).
• trailmark — Builds and queries multi-language source and binary code graphs for security analysis. toml`, and SQL schema graphs.
• trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
• trailmark-review-gate — Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths.
• trailmark-structural — 5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes.
• trailmark-variant-neighborhood — Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions.