Skip to main content
affpapa.org
RU EN
skill CX Codex

trailmark-review-gate — Claude Code skill: how to install

The skill runs structural security gates on branches or pull requests using Trailmark graph diffs. It flags removed auth checks, newly reachable sinks, and expanded attack surfaces.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill trailmark-review-gate -a claude-code
Open on GitHub

What trailmark-review-gate does

The skill evaluates structural changes between commits, branches, or release diffs without altering your working git branch. It relies on Trailmark graph diffs through graph-evolution or equivalent snapshot analysis, requiring engine.preanalysis() on both ends. During this pass, it normalizes changes in call nodes, taint propagation, entry points, complexity metrics, and privilege boundaries.

The output is a compact packet with a verdict: FAIL, WARN, PASS, or UNKNOWN. Because any tool failure forces an UNKNOWN verdict, a broken graph run will never silently pass the review gate. Every finding lists the exact affected nodes or paths alongside caveats for unresolved calls or dynamic dispatch uncertainty.

What it helps with

  • detect removed authorization or validation checks along reachable paths
  • track new entry points and taint flow paths toward sensitive sinks
  • compare privilege boundary shifts and blast radius across git revisions
  • produce a structured evidence packet for pull request reviews

Example prompts for the agent

  • Run a structural review gate between main and my feature branch
  • Check the commit range HEAD~2..HEAD with trailmark-review-gate
  • Inspect graph evolution for this pull request before merging

How to install trailmark-review-gate

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-review-gate -a claude-code

2Manually: put the files in place

~/.claude/skills/trailmark-review-gate/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/trailmark-review-gate/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about trailmark-review-gate

How do I install trailmark-review-gate in Claude Code?

Run npx skills add trailofbits/skills --skill trailmark-review-gate -a claude-code in your terminal.

What is the purpose of trailmark-review-gate?

It detects security regressions at the call-graph level across git diffs, such as dropped auth checks or newly exposed entry points. It complements line-by-line code reviews with structural evidence.

Why does the review gate output UNKNOWN?

The gate emits UNKNOWN whenever Trailmark graph generation fails or evidence is incomplete. A tooling failure is treated as an unassessed risk rather than an automatic pass.

Similar skills

Everything for Security →
code-review coderabbitai Runs CodeRabbit CLI reviews and feeds structured findings back to the agent. Helpful for catching bugs, security risks, and code quality issues before merging. CX Codex +1 14,800installs review-swarm Dimillian Runs a parallel read-only review of a git diff or selected files. Use it to surface regressions, security concerns, and missing test coverage before merging. CX Codex +1 756installs code-review-pro OneWave-AI Reviews files, a module, a diff or a branch and returns severity-ranked findings: vulnerabilities, correctness bugs, performance and maintainability issues, each with evidence and a fix. CX Codex +1 2,600installs find-bugs davila7 Walks the diff on your current branch and reports bugs, security holes and code quality problems. Handy before a merge or a push. 944installs security-guidance official Anthropic Three layers of review for code Claude writes: instant regex warnings, an LLM pass over the diff, and an agentic commit reviewer. ★ 44,635repo stars ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs

From the same set77

c-review Reviews native C/C++ code for memory bugs, integer overflows and races. Use it when auditing userspace applications, daemons or services. CX Codex +1 3,700installs chrome-mcp-troubleshooting Troubleshoots native host clashes between Claude Code and Chrome on macOS. Fixes broken bridge connections when browser tools refuse to run. CX Codex +1 2,400installs rust-review Audits Rust crates and libraries for memory safety in unsafe blocks, FFI boundaries, concurrency bugs, and panic DoS. Useful for in-depth security reviews. CX Codex +1 2,000installs vulnerability-triage-brocards This skill assesses vulnerability reports against seven criteria, helping an agent reject weak findings, ask for evidence, or escalate a report. CX Codex +1 1,400installs trailmark-variant-neighborhood This skill expands a suspected vulnerability into related code locations for review. Use it before variant analysis, Semgrep, static analysis, or a manual audit. CX Codex +1 1,300installs trailmark-finding-triage Builds a graph evidence packet for a single security finding: reachability, entrypoint paths, taint and blast radius. Useful before you spend time on a PoC. CX Codex +1 1,300installs slicing-code-context Extracts bounded, graph-informed source code slices via Trailmark and delegates analysis to a smaller subagent. Useful when running focused tasks on local or constrained models. CX Codex +1 1,300installs github-triage This skill reviews a repository’s open GitHub issues and pull requests, links pending fixes to issues, and prepares local priority and change-size estimates. CX Codex +1 1,300installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor