trailmark-variant-neighborhood

Bind the confirmed finding to a Trailmark graph node, then expand across shared callers, shared sinks, entrypoint paths, interface siblings, and type references. Each candidate is ranked by reachability, taint, and blast radius so reviewers know where to look first.

A variant neighborhood is the set of graph-derived candidate locations that may share the root cause of a seed vulnerability. It includes sibling functions, common sinks, override relationships, and structurally similar nodes, all treated as review targets rather than confirmed findings.

Use graph expansion when the vulnerable pattern depends on call context, shared sinks, or interface relationships rather than pure syntax. If the pattern is purely syntactic and obvious, go directly to a Semgrep rule instead.

No. It outputs ranked review targets, not confirmed findings. Candidates must be handed off to variant-analysis, static-analysis tools like CodeQL, or manual review for semantic confirmation.

The workflow stops before inventing variants. A concrete graph binding is required, and the Skill also stops if the candidate count is too high relative to an underspecified root cause or the target language is unsupported.

Candidates gain priority for entrypoint reachability, taint, privilege-boundary adjacency, high blast radius, shared sinks, and close graph distance. Test, mock, generated, vendor, and unreachable code is penalized or excluded.