Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →trailofbits/audit-augmentation
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.).
Passed 20 of 22 test cases with the skill, and 4 of 22 without it.
and 31 more in the full report
17 fixed3 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 17 test cases the skill fixed. Same model, same prompt, with and without the skill.
I need a shell command to run Trailmark on my local project located at `./core-service`. We generated `security.sarif` from our static analyzer and have `.vscode/team.weaudit` from our manual code review. Please provide the exact CLI command to merge both input artifacts into the project graph and produce structured JSON output.
| Checked | Without skill | With skill |
|---|---|---|
| Uses the command invocation uv run trailmark augment ./core-service. | Missed | Passed |
| Passes --sarif security.sarif. | Passed | Passed |
| Passes --weaudit .vscode/team.weaudit. | Passed | Passed |
| Passes the --json flag. | Missed | Passed |
The instructions your model reads when the skill loads.
Projects findings from external tools (SARIF) and human auditors (weAudit)
onto Trailmark code graphs as annotations and subgraphs. Trailmark 0.4.0+ can
also import an external binary-analysis graph JSON export via
engine.augment_binary().
trailmark-finding-triagetrailmark skill)diagramming-code skill after augmenting)| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "The user only asked about SARIF, skip pre-analysis" | Without pre-analysis, you can't cross-reference findings with blast radius or taint | Always run engine.preanalysis() before augmenting |
| "Unmatched findings don't matter" | Unmatched findings may indicate parsing gaps or out-of-scope files | Report unmatched count and investigate if high |
| "One severity subgraph is enough" | Different severities need different triage workflows | Query all severity subgraphs, not just error |
| "SARIF results speak for themselves" | Findings without graph context lack blast radius and taint reachability | Cross-reference with pre-analysis subgraphs |
| "weAudit and SARIF overlap, pick one" | Human auditors and tools find different things | Import both when available |
| "Tool isn't installed, I'll do it manually" | Manual analysis misses what tooling catches | Install trailmark first |
MANDATORY: If uv run trailmark fails, install trailmark first:
test cases passed, vs 4 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.