audit-augmentation

Map SARIF and weAudit findings onto Trailmark code graphs for security audits.

Updated Jun 9, 2026

Search Tags:#static analysis #code audit #security assessment #SARIF #code graph

Ready to run

npx skills add https://github.com/iiammae/opero --skill audit-augmentation-iiammae

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-augmentation
Source: https://github.com/iiammae/opero/tree/main/.agents/skills/audit-augmentation
Command: npx skills add https://github.com/iiammae/opero --skill audit-augmentation-iiammae

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, and includes scripts (resource) and references (resource) components.

What problem does it solve?

The Skill unit solves the problem of analyzing code graphs to augment them with external audit findings and improve security visibility.

Core Features & Use Cases

External Audit Augmentation: Integrate findings from SARIF and weAudit annotations to provide deeper insights.
Mapping and Subgraphs: Map findings to graph nodes and create subgraphs based on severity, enabling better analysis and cross-referencing.
Pre-Analysis Integration: Integrate findings with pre-analysis data such as blast radius and taint, providing a more comprehensive security overview.

Quick Start

To get started, use the audit-augmentation skill by executing:

uv run trailmark augment /path/to/project --sarif results.sarif

Frequently Asked Questions about audit-augmentation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map SARIF static analysis results onto a code graph?▼

To map SARIF static analysis results onto a code graph, you can use the audit-augmentation skill to integrate findings onto Trailmark code graphs. This enriches the graph structure by visualizing security findings directly within the context of your codebase.

Can I integrate weAudit annotations with my existing security assessment findings?▼

You can integrate weAudit annotations with existing security assessment findings by mapping them onto code graphs. This allows you to combine external audit results from different tools and auditors into a unified view for deeper security insights.

How does visualizing static analysis findings in a code graph improve security audits?▼

Visualizing static analysis findings in a code graph improves security audits by cross-referencing results with pre-analysis data like blast radius and taint. This contextual mapping enables better analysis and creates subgraphs based on vulnerability severity.

What is needed to start augmenting code graphs with SARIF findings?▼

To start augmenting code graphs with SARIF findings, you need the trailmark dependency and a valid SARIF file. You can execute the process via the command line by pointing the augment command to your project path and SARIF results.

Can I create subgraphs based on vulnerability severity from SARIF outputs?▼

You can create subgraphs based on vulnerability severity from SARIF outputs by mapping the findings to specific graph nodes. This enables targeted analysis and better cross-referencing of high-priority security issues within the code structure.