What problem does it solve?
Line-level diffs often miss graph-level security regressions such as new entrypoints, removed authorization checks, or newly reachable sensitive sinks. This Skill turns Trailmark before/after graph evidence into a deterministic review gate with PASS, WARN, FAIL, or UNKNOWN verdicts.
Core Features & Use Cases
- Structural Gate Rules: Detects new untrusted entrypoints, new tainted paths to sensitive sinks, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, and complexity growth.
- Deterministic Verdicts: Emits FAIL, WARN, PASS, or UNKNOWN with conservative default thresholds and explicit rule precedence, never reporting PASS when tooling fails.
- Review Packet Output: Produces a structured Markdown packet with triggered rules, changed nodes, and reviewer actions that integrates with differential-review and PR workflows.
- Use Case: Before merging a remediation commit, compare the vulnerable base against the fix to confirm no new entrypoint or sensitive-sink path appeared and that removed validation is flagged for manual review.
Quick Start
Run the Trailmark review gate on this pull request's before and after refs and give me the gate verdict with any triggered rules.
