# trailmark-finding-triage

Builds a graph evidence packet for a single security finding: reachability, entrypoint paths, taint and blast radius. Useful before you spend time on a PoC.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1300 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-finding-triage/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/trailmark-finding-triage

## What it does

The skill takes one candidate issue — a file and line, a function name, a SARIF result, a weAudit annotation or a report excerpt — and normalises it into a title, path, suspected source or sink, and claimed impact. With no concrete code anchor it stops and asks for one.

Then it builds a Trailmark graph, or reuses a fresh one from `.trailmark/`, binds the finding to a node and runs a query recipe: entrypoint paths with their trust levels, membership in the `tainted`, `privilege_boundary` and `high_blast_radius` subgraphs, direct callers and callees, downstream sinks. For file and line anchors there is a bundled script, `scripts/evidence_packet.py`, that builds the graph once and handles several findings in one pass, writing the packet as JSON. It runs through `uv run --no-project`, so `uv` has to be on the machine.

Reachability in the graph is not proof of exploitability. An empty path list can also mean the analysis is limited — dynamic dispatch, proxies, an incomplete entrypoint model. An auth check sitting on the path is a review target, not a clean bill of health. The output is one verdict: `Promote`, `Needs manual review` or `Deprioritize`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-finding-triage -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/trailmark-finding-triage/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/trailmark-finding-triage/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-finding-triage -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/trailmark-finding-triage/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-finding-triage -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/trailmark-finding-triage/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills trailmark-finding-triage
```

2. **Manually: put the files in place**
- File: `.github/skills/trailmark-finding-triage/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-finding-triage -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/trailmark/skills/trailmark-finding-triage
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/trailmark-finding-triage/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-finding-triage -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-finding-triage/SKILL.md

## When to use it
- decide whether a scanner result deserves PoC time
- check if a manual finding is reachable from an entrypoint
- assemble evidence before validating an exploit
- triage a suspicious function spotted during manual audit
- judge whether to promote or shelve a finding

## Example prompts
- Triage the finding at `src/auth/session.c:142` — is it reachable from any entrypoint?
- Build the evidence packet for this function before I write a PoC
- Check this SARIF result for a path from an entrypoint with untrusted input

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md