skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

audit-augmentation

Projects SARIF and weAudit findings onto Trailmark code graphs as annotations and subgraphs.

Updated Apr 5, 2026
Search Tags:#static analysis#security audit#codeql#semgrep#SARIF#code graph#weaudit
One-click install
npx skills add https://github.com/marumo333/atrox --skill audit-augmentation-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-augmentation
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/trailmark/skills/audit-augmentation
Command: npx skills add https://github.com/marumo333/atrox --skill audit-augmentation-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, and includes references (resource) components.

What problem does it solve? Static analysis results and human audit notes live in separate files disconnected from code structure, making it hard to prioritize findings by blast radius, taint reachability, or privilege boundaries. This Skill overlays SARIF tool output and weAudit annotations onto Trailmark code graphs so findings can be queried and cross-referenced in context. ## Core Features & Use Cases - SARIF Import: Maps Semgrep, CodeQL, and other SARIF 2.1.0 results to graph nodes by file path and line overlap, creating severity-based subgraphs like sarif:error and per-tool subgraphs. - weAudit Import: Converts VSCode weAudit findings and notes into graph annotations with severity subgraphs (weaudit:high, weaudit:medium, weaudit:low), handling 0-indexed to 1-indexed line conversion. - Cross-Referencing: Overlaps findings with pre-analysis subgraphs (tainted, high_blast_radius, privilege_boundary) to prioritize triage. - Use Case: After running Semgrep on a Python codebase, import the SARIF output into a Trailmark graph, then query which high-severity findings sit on tainted nodes to focus remediation on exploitable paths. ## Quick Start Ask the AI to augment the code graph in your target directory with your SARIF results file and weAudit annotations, then list the high-severity findings.

Frequently Asked Questions about audit-augmentation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I import SARIF results into a Trailmark code graph?▼

Run `uv run trailmark augment {targetDir} --sarif results.sarif` from the CLI, or call `engine.augment_sarif("results.sarif")` programmatically after building the graph with QueryEngine. Findings are matched to nodes by file path and line range overlap.

How to cross-reference Semgrep findings with call graph data?▼

Run Semgrep with `--sarif -o results.sarif`, then augment the Trailmark graph and call `engine.preanalysis()` first. Overlap the `sarif:error` subgraph with `tainted` or `high_blast_radius` subgraphs to prioritize findings by reachability and impact.

Does the augmentation support weAudit VSCode annotation files?▼

Yes, weAudit files stored in `.vscode/<username>.weaudit` are supported via `engine.augment_weaudit()` or the `--weaudit` CLI flag. Entry types map to findings or audit notes, and 0-indexed lines are converted to 1-indexed automatically.

Why are some SARIF findings unmatched after augmentation?▼

Unmatched findings occur when a finding's file path or line range does not overlap any parsed code unit in the graph. Check the `unmatched_findings` count in the result; a high count may indicate parsing gaps or out-of-scope files worth investigating.

When should I not use audit augmentation?▼

Do not use it to run static analysis tools themselves; run Semgrep or CodeQL directly first, then import results. It also does not build the code graph (use the trailmark skill) or generate diagrams (use the diagramming-code skill afterward).

Related Skills

Explore More Software Engineering Skills→
ayehiaaayehiaa

trailmark

Generate and query a static security call graph from source code.

Community
Advanced
manuelbrandner85manuelbrandner85

audit-augmentation

Map SARIF and weAudit findings onto Trailmark code graphs.

Community
Advanced
irrit-usirrit-us

audit-augmentation

Projects SARIF and weAudit findings onto Trailmark code graphs as annotations and severity subgraphs.

Official
Intermediate
trailofbitstrailofbits
6.9k

trailmark-finding-triage

Triages a single security finding using Trailmark graph reachability, taint, and blast-radius evidence.

Official
Advanced