skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

graph-evolution

Compares Trailmark code graphs between two snapshots to detect security-relevant structural changes.

Updated Apr 5, 2026
Search Tags:#security analysis#attack surface#taint analysis#code graph#trailmark#structural diff#git comparison
One-click install
npx skills add https://github.com/marumo333/atrox --skill graph-evolution-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graph-evolution
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/trailmark/skills/graph-evolution
Command: npx skills add https://github.com/marumo333/atrox --skill graph-evolution-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, and includes scripts (resource) and references (resource) components.

What problem does it solve? Text-level diffs miss structural security changes like new attack paths, taint propagation shifts, blast radius growth, and privilege boundary modifications. This Skill builds Trailmark code graphs at two source snapshots (git commits, tags, or directories) and computes a structural diff that surfaces these hidden changes. ## Core Features & Use Cases - Structural Graph Diffing: Compares nodes, edges, complexity, and subgraph membership (tainted, high_blast_radius, privilege_boundary, entrypoints) between two snapshots. - Security-Focused Reporting: Generates a severity-classified markdown report (CRITICAL to INFO) highlighting new tainted paths, attack surface growth, and removed security controls. - Use Case: Before releasing v1.3.0, compare it against v1.2.0 to discover that a new function creates an untrusted path to a database query, then cross-reference with git diff for source-level context. ## Quick Start Ask the AI to compare the code graphs between git tag v1.2.0 and v1.3.0 using graph-evolution and produce a security report of structural changes.

Frequently Asked Questions about graph-evolution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I compare code structure between two git commits for security changes?▼

Build Trailmark graphs at each ref using git worktrees, run pre-analysis on both, then execute graph_diff.py on the exported JSON files. The output highlights added attack paths, complexity shifts, and subgraph membership changes.

What security changes can a structural code graph diff detect that git diff cannot?▼

Structural diffs detect new tainted paths to sensitive functions, blast radius growth, privilege boundary modifications, and transitive complexity shifts. Text diffs only show line-level changes and miss these cross-cutting structural effects.

Does graph-evolution work without the trailmark tool installed?▼

No, trailmark must be installed via uv pip install trailmark before use. The Skill explicitly rejects manual comparison as a fallback because manual review misses what graph analysis catches.

When should I use differential-review instead of graph-evolution?▼

Use differential-review for line-level code review of text diffs with git blame context. Use graph-evolution for structural analysis across snapshots; the two skills are complementary and often used together.

How are findings classified in a graph evolution report?▼

Findings are classified from CRITICAL (new tainted path to sensitive function, removed auth boundary) down to INFO (dead code removal, complexity reductions). Classification is based on structural signals like subgraph membership and CC deltas.

Related Skills

Explore More Software Engineering Skills→
irrit-usirrit-us

graph-evolution

Compares Trailmark code graphs between two snapshots to detect security-relevant structural changes.

Official
Advanced
manuelbrandner85manuelbrandner85

genotoxic

Analyze mutation testing results using code graph analysis to categorize survived mutants.

Community
Advanced
TECH-HYTECH-HY

differential-review

Performs security-focused differential review of code changes using git history and blast radius analysis.

Official
Advanced
digitalhanddigitalhand

godot-gdscript-patterns

Provide GDScript coding patterns and best practices for the Godot Engine.

Official
Intermediate