graph-evolution agent skill by trailofbits
Compares Trailmark code graphs at two source snapshots to surface security-relevant structural changes, including new attack paths, complexity shifts, and blast radius growth.
At a glance
| Publisher | Trail of Bits Official |
|---|---|
| Repository | trailofbits/skills (83 listed skills) |
| Category | Security |
| License | CC-BY-SA-4.0 |
| Last commit | October 15, 2026 (repository) |
| SKILL.md | 340 lines, 1,785 words |
| Bundled files | 6 files, including references, scripts, assets or templates |
| Quality score | 89/100 · B Passes all seven graded checks |
| Security scan | Not scanned |
| README badge | Get the badges for this listing |
Before you install
Read from the skill's files at the directory's October 22, 2026 snapshot: what ships with it, what its code reads, and the terms it is published under.
- Bundled scripts: 1 script file (1 Python). Your agent may run them, so read them first.
- License: CC-BY-SA-4.0, an open-source or open-content license.
Install graph-evolution
The skills CLI works with Claude Code, Codex, Cursor and other agents; the other routes copy the folder by hand.
npx skills add https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/graph-evolutiontmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .claude/skills
cp -R "$tmp/repo/"plugins/trailmark/skills/graph-evolution .claude/skills/
rm -rf "$tmp"tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .agents/skills
cp -R "$tmp/repo/"plugins/trailmark/skills/graph-evolution .agents/skills/
rm -rf "$tmp"For a user-level install, copy the folder to ~/.claude/skills/ (Claude Code) or ~/.agents/skills/ (Codex). Inside Codex, $skill-installer can also fetch a skill from GitHub. New to skills? Read How to install agent skills in Claude Code, Codex and Cursor.
trailofbits/skills is third-party code. Read SKILL.md and any bundled scripts before you install it.
How the author describes it
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.
From the description field of SKILL.md. Agents read this line to decide when to load the skill.
Sections in SKILL.md
- When to Use
- When NOT to Use
- Rationalizations to Reject
- Prerequisites
- Quick Start
- Decision Tree
- Workflow
- Phase 1: Create Snapshots
- Phase 2: Build Graphs and Run Pre-Analysis
- Phase 3: Compute Structural Diff
- Phase 4: Interpret Diff and Generate Report
- Phase 5: Clean Up
- Diff Reference
- Quality Checklist
- Integration
- Supporting Documentation
Files in the skill folder
SKILL.mdagents/openai.yamlassets/trail-of-bits-mark.svgreferences/evolution-metrics.mdreferences/report-format.mdscripts/graph_diff.py
Suede Skill Check: 89/100 · B
Report snapshot · · graded-v2
The rubric totals 100 points; published scores are capped at 99. Security scan: not scanned.
Source revision: 5c99c03fb8a9. Report version f2927621fc6a. Badge URLs follow the latest listing; save the report to keep this version.
Download report · Request a fresh review
What to review next
- Boundary clause: 0 of 4 points. 4 when the description says when not to use the skill (“Not for …”, “Do not use …”, “Use … instead”).
- Example request: 0 of 3 points. 3 when the description quotes an example request (3–60 characters in quotation marks).
- Tool permissions declared: 0 of 2 points. 2 when the frontmatter declares allowed-tools.
Add declarations and bundled files when they describe the skill’s actual needs. Update the source, then request a fresh review with the changed commit or PR.
graph-evolution passes the required frontmatter check and all seven graded checks, which cover the SKILL.md format, a declared license and a commit in the last year. Those checks earn 56 of the score’s points; the rest come from description quality, instruction depth, bundled files, maintenance and curated-list citations. How the score works.
See the checks and points
| Check | Result |
|---|---|
| Frontmatter parses and declares a name and a description | Pass |
| Name uses lowercase letters, digits and hyphens, 64 characters or fewer | Pass |
| Name matches the skill's folder name | Pass |
| Description is between 50 and 1,024 characters | Pass |
| Description says when an agent should use the skill | Pass |
| SKILL.md body is 500 lines or fewer | Pass |
| A license is declared in the frontmatter or the repository | Pass |
| Repository has a commit in the last 12 months | Pass |
| Score component | Points |
|---|---|
| Structural checks | 56 of 56 |
| Description length | 5 of 5 |
| Boundary clause | 0 of 4 |
| Example request | 0 of 3 |
| Instruction depth | 7 of 7 |
| Reference files | 3 of 3 |
| Bundled scripts | 2 of 2 |
| Recent maintenance | 9 of 9 |
| Curated-list citations | 7 of 7 |
| Tool permissions declared | 0 of 2 |
| Compatibility declared | 0 of 2 |
Two badges for graph-evolution
Choose the numeric badge, the letter badge, or both. Each links to this skill’s Suede AI listing; either valid linked badge can qualify for the feature offer.
[](https://suedeai.directory/trailofbits/skills/graph-evolution/)
[](https://suedeai.directory/trailofbits/skills/graph-evolution/)<a href="https://suedeai.directory/trailofbits/skills/graph-evolution/"><img src="https://suedeai.directory/trailofbits/skills/graph-evolution/score.svg" alt="Suede Skill Check: 89/100" width="160" height="175"></a>
<a href="https://suedeai.directory/trailofbits/skills/graph-evolution/"><img src="https://suedeai.directory/trailofbits/skills/graph-evolution/badge.svg" alt="Suede Skill Check: Grade B" width="160" height="175"></a>Suede Certified on the shield refers to this published structural quality check. Security scan: not scanned. Read the methodology.
Limited-time feature offer: Display either quality badge in your repository or skill README, linked to your listing, then request verification. Suede AI checks the rendered README at a recorded commit. Eligible skills scoring 80–99 with a verified badge can receive a featured placement while the offer is open. Request badge verification.
Publishers: read How to get your agent skill found in search and cited by AI assistants.
Where this skill is cited
trailofbits/skills appears in 4 curated lists: BehiSecc/awesome-claude-skills, heilcheng/awesome-agent-skills, hesreallyhim/awesome-claude-code, travisvn/awesome-claude-skills.