skill CX Codex

trailmark-variant-neighborhood — Claude Code skill

Q: How do I install trailmark-variant-neighborhood in Claude Code?

Run `npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a claude-code`, then run `npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a claude-code` again. The skill is placed at `~/.claude/skills/trailmark-variant-neighborhood/SKILL.md`.

This skill expands a suspected vulnerability into related code locations for review. Use it before variant analysis, Semgrep, static analysis, or a manual audit.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a claude-code

Open on GitHub

What trailmark-variant-neighborhood does

The skill accepts finding text, a file and line, a function name, or output from trailmark-finding-triage. It binds that seed to a Trailmark graph node, then explores nearby relationships such as shared callers and callees, sensitive sinks, entrypoint paths, interface implementations, overrides, type references, and structurally similar code.

Candidates are ranked using reachability, boundary proximity, shared sinks, interface links, and related signals. Tests, mocks, generated files, and vendor code are pushed down the list. The result is a handoff packet with candidate locations, inclusion reasons, exclusions, limits, and a suggested next step for variant-analysis, semgrep-rule-creator, static analysis, or manual review.

This is a review-target generator, not a vulnerability verdict. The workflow stops when the seed cannot bind to a graph node, the candidate set is too large, or Trailmark cannot analyze the target language. A seed limited to test, generated, or vendor code also affects whether the workflow can proceed.

What it helps with

find related code after one vulnerability is spotted
trace shared callers, callees, and sensitive sinks
locate interface implementations and override siblings
rank candidates reachable from an entrypoint
prepare a handoff for variant analysis or Semgrep

Example prompts for the agent

Use trailmark-variant-neighborhood on the finding in src/auth.ts and return related locations for review.
Take the trailmark-finding-triage result, bind its seed to the Trailmark graph, and prepare candidates for variant-analysis.
Search for neighbors sharing a sink or entrypoint path, then create a handoff for manual review.

How to install trailmark-variant-neighborhood

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a claude-code

2Manually: put the files in place

~/.claude/skills/trailmark-variant-neighborhood/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/trailmark-variant-neighborhood/

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a codex

2Manually: put the files in place

.agents/skills/trailmark-variant-neighborhood/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a cursor

2Manually: put the files in place

.cursor/skills/trailmark-variant-neighborhood/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install trailofbits/skills trailmark-variant-neighborhood

2Manually: put the files in place

.github/skills/trailmark-variant-neighborhood/SKILL.md

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a gemini-cli

2Platform CLI

gemini skills install https://github.com/trailofbits/skills --path plugins/trailmark/skills/trailmark-variant-neighborhood

Manually: put the files in place

.devin/skills/trailmark-variant-neighborhood/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about trailmark-variant-neighborhood

How do I install trailmark-variant-neighborhood in Claude Code?

Run npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a claude-code, then run npx skills add trailofbits/skills --skill trailmark-variant-neighborhood -a claude-code again. The skill is placed at ~/.claude/skills/trailmark-variant-neighborhood/SKILL.md.

What does trailmark-variant-neighborhood do?

It expands a confirmed or suspected vulnerability into related Trailmark graph nodes for follow-up review. Its output contains candidates, not confirmed vulnerabilities.

What does the skill need before it can run?

The seed finding must bind to a Trailmark graph node. The workflow also stops when Trailmark cannot analyze the target language.

Similar skills

Everything for Security →

semgrep semgrep Runs Semgrep static analysis and helps you write YAML detection rules. Useful when you need to find vulnerabilities or enforce your own coding standards. CX Codex +1 2,200installs tooluniverse-variant-analysis mims-harvard A skill for VCF and variant analysis: parsing, annotation, classification, notation conversion and lookups against external databases. Useful when variants need sorting out. CX Codex +1 371installs security-reviewer https://github.com/Jeffallan Finds code and infrastructure vulnerabilities, assigns severity ratings, and suggests fixes. Use it for audits, secret scanning, and dependency checks. CX Codex +1 6,000installs security-bounty-hunter affaan-m Finds remotely reachable vulnerabilities that can support a bounty report. Use it when you need an exploitable path, not a broad security checklist. CX Codex +1 4,500installs code-security semgrep Security guidelines for writing safe code and catching vulnerabilities across 15+ languages. Helps inspect database queries, network calls, and infrastructure configurations. CX Codex +1 2,600installs skill-scanner getsentry Scans agent skills for prompt injection, malicious code, excessive permissions, secret exposure, and supply-chain risks before installation. CX Codex +1 3,800installs

From the same set77

chrome-mcp-troubleshooting Troubleshoots native host clashes between Claude Code and Chrome on macOS. Fixes broken bridge connections when browser tools refuse to run. CX Codex +1 2,400installs rust-review Audits Rust crates and libraries for memory safety in unsafe blocks, FFI boundaries, concurrency bugs, and panic DoS. Useful for in-depth security reviews. CX Codex +1 2,000installs vulnerability-triage-brocards This skill assesses vulnerability reports against seven criteria, helping an agent reject weak findings, ask for evidence, or escalate a report. CX Codex +1 1,400installs trailmark-review-gate The skill runs structural security gates on branches or pull requests using Trailmark graph diffs. It flags removed auth checks, newly reachable sinks, and expanded attack surfaces. CX Codex +1 1,300installs trailmark-finding-triage Builds a graph evidence packet for a single security finding: reachability, entrypoint paths, taint and blast radius. Useful before you spend time on a PoC. CX Codex +1 1,300installs slicing-code-context Extracts bounded, graph-informed source code slices via Trailmark and delegates analysis to a smaller subagent. Useful when running focused tasks on local or constrained models. CX Codex +1 1,300installs github-triage This skill reviews a repository’s open GitHub issues and pull requests, links pending fixes to issues, and prepares local priority and change-size estimates. CX Codex +1 1,300installs open-sourcing Walks a repository through the pre-release checklist: secret audit, license, docs, CI and packaging. CX Codex +1 1,300installs