trailmark-finding-triage agent skill by trailofbits

At a glance

Before you install

Read from the skill's files at the directory's October 22, 2026 snapshot: what ships with it, what its code reads, and the terms it is published under.

• Bundled scripts: 2 script files (2 Python). Your agent may run them, so read them first.
• Tool permissions requested: Bash, Read, Grep, Glob, Write (the allowed-tools field of SKILL.md).
• License: CC-BY-SA-4.0, an open-source or open-content license.

Install trailmark-finding-triage

The skills CLI works with Claude Code, Codex, Cursor and other agents; the other routes copy the folder by hand.

npx skills add https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/trailmark-finding-triage

tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .claude/skills
cp -R "$tmp/repo/"plugins/trailmark/skills/trailmark-finding-triage .claude/skills/
rm -rf "$tmp"

tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/trailofbits/skills.git "$tmp/repo"
mkdir -p .agents/skills
cp -R "$tmp/repo/"plugins/trailmark/skills/trailmark-finding-triage .agents/skills/
rm -rf "$tmp"

For a user-level install, copy the folder to ~/.claude/skills/ (Claude Code) or ~/.agents/skills/ (Codex). Inside Codex, $skill-installer can also fetch a skill from GitHub. New to skills? Read How to install agent skills in Claude Code, Codex and Cursor.

trailofbits/skills is third-party code. Read SKILL.md and any bundled scripts before you install it.

How the author describes it

Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.

From the description field of SKILL.md. Agents read this line to decide when to load the skill.

Sections in SKILL.md

• When to Use
• When NOT to Use
• Rationalizations to Reject
• Workflow
• Step 1: Normalize the Candidate
• Shortcut for Steps 2–4 (file/line findings)
• Step 2: Build Or Reuse The Graph
• Step 3: Bind The Candidate
• Step 4: Analyze Graph Evidence
• Step 5: Decide And Handoff
• Example Prompts

Files in the skill folder

• SKILL.md
• agents/openai.yaml
• assets/trail-of-bits-mark.svg
• references/input-normalization.md
• references/output-format.md
• references/query-recipes.md
• scripts/evidence_packet.py
• scripts/test_evidence_packet.py

Suede Skill Check: 91/100 · A

trailmark-finding-triage passes the required frontmatter check and all seven graded checks, which cover the SKILL.md format, a declared license and a commit in the last year. Those checks earn 56 of the score’s points; the rest come from description quality, instruction depth, bundled files, maintenance and curated-list citations. How the score works.

Where this skill is cited

trailofbits/skills appears in 4 curated lists: BehiSecc/awesome-claude-skills, heilcheng/awesome-agent-skills, hesreallyhim/awesome-claude-code, travisvn/awesome-claude-skills.

More security skills

All security skills

More from trailofbits/skills

All 83 skills in trailofbits/skills