skills.rest
trailofbits
trailofbitsOFFICIAL
Explore all skills by this author →
Website𝕏@trailofbitsGitHub

audit-augmentation

Integrates SARIF and weAudit static analysis findings into code graphs for security analysis.

6.5k|561|Updated Jan 14, 2026
Search Tags:#static analysis#security analysis#SARIF#code auditing#weAudit
One-click install
npx skills add https://github.com/trailofbits/skills --skill audit-augmentation-trailofbits
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-augmentation
Source: https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/audit-augmentation
Command: npx skills add https://github.com/trailofbits/skills --skill audit-augmentation-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the challenge of integrating external audit findings from tools like SARIF and weAudit into code graphs for comprehensive security analysis.

Core Features & Use Cases

  • Audit Finding Integration: Maps findings from SARIF static analysis results and weAudit annotation files to code graph nodes.
  • Severity-Based Subgraphs: Creates subgraphs based on severity levels for easier triage.
  • Cross-Referencing: Enables cross-referencing findings with pre-analysis data for deeper context.
  • Use Case: For security analysts who need to overlay audit findings onto code graphs for a more complete understanding of potential vulnerabilities.

Quick Start

To augment a code graph with SARIF results, run:

uv run trailmark augment {targetDir} --sarif results.sarif

Frequently Asked Questions about audit-augmentation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate SARIF static analysis findings into a code graph for security analysis?▼

SARIF static analysis findings are integrated into code graphs by mapping results to code graph nodes using file path and line overlap matching, augmenting the graph for comprehensive security analysis.

What is the best way to overlay weAudit annotation files onto code graphs?▼

weAudit annotation files are overlaid onto code graphs by mapping audit findings to graph nodes based on file path and line overlap, enabling cross-referencing with pre-analysis data for deeper context.

Does augmenting code graphs with audit findings require Trailmark?▼

Yes, augmenting code graphs with audit findings requires Trailmark for code graph construction and augmentation, serving as the foundational dependency for processing SARIF and weAudit inputs.

How do I create subgraphs based on severity levels from static analysis results?▼

Subgraphs based on severity levels are created automatically when static analysis findings from SARIF or weAudit are mapped to the code graph, allowing easier triage of vulnerabilities by severity.

Can I cross-reference external audit findings with pre-analysis data in a code graph?▼

External audit findings from SARIF and weAudit can be cross-referenced with pre-analysis data within the code graph, providing deeper context for security analysts evaluating potential vulnerabilities.

What limitations exist when matching audit findings to code graph nodes?▼

Finding placement relies on file path and line overlap matching for integration into code graphs, meaning findings without precise location data may not map accurately to the corresponding code graph nodes.

Related Skills

Explore More Software Engineering Skills→
manuelbrandner85manuelbrandner85

audit-augmentation

Map SARIF and weAudit findings onto Trailmark code graphs.

Community
Advanced
rohanbhatia27rohanbhatia27
1

audit-augmentation

Enhances code graphs with SARIF audit findings mapped to nodes by file and line overlap.

Community
Advanced
iiammaeiiammae

audit-augmentation

Map SARIF and weAudit findings onto Trailmark code graphs for security audits.

Community
Advanced
ayehiaaayehiaa

audit-augmentation

Overlay SARIF and weAudit findings onto Trailmark code graph nodes.

Community
Intermediate