trailmark-variant-neighborhood

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, security, trailmark, variant-analysis.

What it does

Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/trailmark-variant-neighborhood ~/.claude/skills/trailmark-variant-neighborhood

Safety box score

Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation-only: it contains Markdown guidance, one YAML metadata file, and an SVG asset, with no executable scripts or remote fetches. Its purpose is to help an agent rank graph-neighborhood review targets for later analysis, so the main risk is analytical overreach rather than direct machine impact.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts, interpreters, or code-evaluation steps are shipped; the files are `SKILL.md`, `references/*.md`, `agents/openai.yaml`, and an SVG asset.
Network access	0 (none)	There are no download commands, API calls, or outbound data-transfer steps in the skill files.
Filesystem reach	0 (none)	The skill only describes analysis workflow and output formatting; it does not read, write, or delete files outside the repository.
Secrets & credentials	0 (none)	It does not request tokens, passwords, `.env` files, keychains, or browser sessions, and it does not ask the user to paste secrets.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell-startup modification, or OS/git configuration change anywhere in the shipped files.
Instruction hijack surface	0 (none)	The content is plain workflow guidance; it does not instruct the agent to ignore higher-priority instructions, hide actions, or follow remote content.
Irreversible actions	0 (none)	It explicitly says to generate review targets, not findings or actions, and the handoff format is for later manual or tool-assisted review rather than autonomous execution.
Transparency	0 (none)	All shipped content is human-readable Markdown/YAML/SVG; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Verify the package contains only the documented Markdown, YAML, and SVG files; there are no hidden scripts to execute.
Confirm your environment already has the Trailmark analyzer this skill assumes, since the skill itself does not install or configure one.
Use it only for analysis workflows; it does not perform remediation, deployment, or any external-side effects.

Rated 2026-10-19 by an automated review of 6 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/trailmark/skills/trailmark-variant-neighborhood/SKILL.md
Branch: main
Collection: trailmark
Updated: 2026-09-19

audit-augmentation — Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files.
graph-evolution — Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes.
trailmark — Builds and queries multi-language source and binary code graphs for security analysis.
trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
trailmark-review-gate — Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths.
trailmark-structural — Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries.