# trailmark-review-gate

The skill runs structural security gates on branches or pull requests using Trailmark graph diffs. It flags removed auth checks, newly reachable sinks, and expanded attack surfaces.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1300 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-review-gate/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/trailmark-review-gate

## What it does

The skill evaluates structural changes between commits, branches, or release diffs without altering your working git branch. It relies on Trailmark graph diffs through `graph-evolution` or equivalent snapshot analysis, requiring `engine.preanalysis()` on both ends. During this pass, it normalizes changes in call nodes, taint propagation, entry points, complexity metrics, and privilege boundaries.

The output is a compact packet with a verdict: `FAIL`, `WARN`, `PASS`, or `UNKNOWN`. Because any tool failure forces an `UNKNOWN` verdict, a broken graph run will never silently pass the review gate. Every finding lists the exact affected nodes or paths alongside caveats for unresolved calls or dynamic dispatch uncertainty.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-review-gate -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/trailmark-review-gate/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/trailmark-review-gate/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-review-gate -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/trailmark-review-gate/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-review-gate -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/trailmark-review-gate/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills trailmark-review-gate
```

2. **Manually: put the files in place**
- File: `.github/skills/trailmark-review-gate/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-review-gate -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/trailmark/skills/trailmark-review-gate
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/trailmark-review-gate/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill trailmark-review-gate -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/trailmark/skills/trailmark-review-gate/SKILL.md

## When to use it
- detect removed authorization or validation checks along reachable paths
- track new entry points and taint flow paths toward sensitive sinks
- compare privilege boundary shifts and blast radius across git revisions
- produce a structured evidence packet for pull request reviews

## Example prompts
- Run a structural review gate between main and my feature branch
- Check the commit range HEAD~2..HEAD with trailmark-review-gate
- Inspect graph evolution for this pull request before merging

## Similar
- [code-review](https://affpapa.org/en/nevibecode/skills/coderabbitai-code-review.md) — skill · 14800 installs
- [review-swarm](https://affpapa.org/en/nevibecode/skills/review-swarm.md) — skill · 756 installs
- [code-review-pro](https://affpapa.org/en/nevibecode/skills/code-review-pro.md) — skill · 2600 installs
- [find-bugs](https://affpapa.org/en/nevibecode/skills/find-bugs.md) — skill · 944 installs
- [security-guidance](https://affpapa.org/en/nevibecode/plugins/security-guidance.md) — plugin · ★ 44635
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md