Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

audit-augmentation — Claude Code skill: what it does, how to install

Projects SARIF static analysis reports, weAudit notes, and binary graphs onto Trailmark code graphs. Useful when mapping vulnerabilities to call graphs and data taint paths.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill audit-augmentation -a claude-code
Open on GitHub

What audit-augmentation does

The skill maps external audit findings onto Trailmark code graphs. It matches findings from SARIF files generated by Semgrep or CodeQL alongside weAudit annotations by checking file paths and line ranges. The engine then builds severity subgraphs such as sarif:error or weaudit:high.

It does not run static analysis tools or construct the base graph. You must run engine.preanalysis() before loading findings. Skipping pre-analysis breaks cross-referencing with taint propagation and blast radius. That defeats the purpose of graph augmentation.

You need the Trailmark tool installed via uv. Binary graph ingestion requires Trailmark 0.4.0 or newer through engine.augment_binary(). Starting with version 0.5.0, links to external binary symbols can be declared inside .trailmark/links.toml.

What it helps with

  • project Semgrep and CodeQL SARIF results onto a code graph
  • import manual auditor notes from weAudit files
  • isolate functions with high-severity issues using severity subgraphs
  • cross-reference static findings with blast radius and taint reachability
  • load external binary graph exports into the source code graph

Example prompts for the agent

  • Import results.sarif into the Trailmark graph and show functions with high-severity findings
  • Overlay audit notes from .vscode/alice.weaudit onto the graph and check overlap with tainted nodes
  • Run trailmark augment on the target directory with results.sarif and output JSON

How to install audit-augmentation

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill audit-augmentation -a claude-code

2Manually: put the files in place

~/.claude/skills/audit-augmentation/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/audit-augmentation/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

browser-login ruvnet Authenticates against a site once, sanitizes cookies through AIDefence, vaults the session handle, and lets other skills reuse it without re-logging in. Claude Code CX Codex Cursor +1 729installs iot-witness-verify ruvnet Verifies witness chain integrity for Cognitum Seed devices and detects provenance gaps. Useful for uncovering broken hash chains and missing epochs. Claude Code CX Codex Cursor +1 728installs computer-use-agents sickn33 Guides the architecture of AI agents that control screens, cursors, and keystrokes using Anthropic Computer Use or OpenAI Operator. Useful for sandboxed desktop and GUI automation. Claude Code CX Codex Cursor +1 959installs plaid-fintech sickn33 Provides integration patterns for the Plaid API, covering Link tokens, ACH Auth, transaction sync, balance checks, and webhook handling. Claude Code CX Codex Cursor +1 956installs browser-form-fill ruvnet Fills web forms using a structured JSON field map and saved selector templates. It automates data entry and form submission directly in browser sessions. Claude Code CX Codex Cursor +1 717installs salesforce-component-standards official github Guides Salesforce UI development across LWC, Aura, and Visualforce. Enforces SLDS 2 compliance, accessibility, and platform security. GitHub Copilot 770installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about audit-augmentation

How to install audit-augmentation in Claude Code?

Run npx skills add trailofbits/skills --skill audit-augmentation -a claude-code. If Trailmark is missing, install it with uv tool install trailmark.

What does audit-augmentation do?

It maps SARIF analysis outputs, weAudit notes, and binary graph exports onto Trailmark code graphs. This groups issues into severity subgraphs and lets you evaluate their impact across connected functions.

Why must preanalysis run before importing findings?

Without pre-analysis, the graph lacks blast radius and taint reachability data. Running engine.preanalysis() lets you cross-reference detected vulnerabilities with data-flow paths.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor