trailmark-finding-triage

Provide the finding's file and line, function name, or SARIF result and the skill binds it to a Trailmark graph node. It then checks entrypoint reachability, taint, and blast radius, returning a verdict of Promote, Needs manual review, Deprioritize, or Blocked.

It accepts file/line references, function names, SARIF results, weAudit annotations, Markdown finding excerpts, and manual claims. Every input is normalized into a candidate record with title, location, suspected source or sink, and claimed impact before graph analysis.

No. The skill explicitly separates graph reachability from exploitability. A reachable path still needs attacker-controlled inputs and compatible preconditions, so auth checks and validators are flagged as manual review targets rather than proof of safety or exploitability.

The skill reports a binding limitation instead of guessing, and the verdict becomes Blocked. It records the cause, such as unsupported languages, parser errors, dynamic dispatch, or ambiguous matches, in the evidence packet's limitations section.

Avoid it when multiple weak findings might compose into a chain, when you need a full audit or remediation review, or when the target is a PR diff. Use composition, audit, remediation-review, or graph-evolution workflows for those cases.