audit-augmentation

Integrates SARIF and weAudit static analysis findings into code graphs for security analysis.

6.5k|561|Updated Jan 14, 2026

Search Tags:#static analysis #security analysis #SARIF #code auditing #weAudit

Ready to run

npx skills add https://github.com/trailofbits/skills --skill audit-augmentation-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-augmentation
Source: https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/audit-augmentation
Command: npx skills add https://github.com/trailofbits/skills --skill audit-augmentation-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the challenge of integrating external audit findings from tools like SARIF and weAudit into code graphs for comprehensive security analysis.

Core Features & Use Cases

Audit Finding Integration: Maps findings from SARIF static analysis results and weAudit annotation files to code graph nodes.
Severity-Based Subgraphs: Creates subgraphs based on severity levels for easier triage.
Cross-Referencing: Enables cross-referencing findings with pre-analysis data for deeper context.
Use Case: For security analysts who need to overlay audit findings onto code graphs for a more complete understanding of potential vulnerabilities.

Quick Start

To augment a code graph with SARIF results, run:

uv run trailmark augment {targetDir} --sarif results.sarif

Frequently Asked Questions about audit-augmentation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I integrate SARIF static analysis findings into a code graph for security analysis?▼

SARIF static analysis findings are integrated into code graphs by mapping results to code graph nodes using file path and line overlap matching, augmenting the graph for comprehensive security analysis.

What is the best way to overlay weAudit annotation files onto code graphs?▼

weAudit annotation files are overlaid onto code graphs by mapping audit findings to graph nodes based on file path and line overlap, enabling cross-referencing with pre-analysis data for deeper context.

Does augmenting code graphs with audit findings require Trailmark?▼

Yes, augmenting code graphs with audit findings requires Trailmark for code graph construction and augmentation, serving as the foundational dependency for processing SARIF and weAudit inputs.

How do I create subgraphs based on severity levels from static analysis results?▼

Subgraphs based on severity levels are created automatically when static analysis findings from SARIF or weAudit are mapped to the code graph, allowing easier triage of vulnerabilities by severity.

Can I cross-reference external audit findings with pre-analysis data in a code graph?▼

External audit findings from SARIF and weAudit can be cross-referenced with pre-analysis data within the code graph, providing deeper context for security analysts evaluating potential vulnerabilities.

What limitations exist when matching audit findings to code graph nodes?▼

Finding placement relies on file path and line overlap matching for integration into code graphs, meaning findings without precise location data may not map accurately to the corresponding code graph nodes.