audit-augmentation — Skills

What it does

Importing Semgrep, CodeQL, or other SARIF-producing tool results into a graph

Importing weAudit audit annotations into a graph

Cross-referencing static analysis findings with blast radius or taint data

Querying which functions have high-severity findings

Visualizing audit coverage alongside code structure

Running static analysis tools (use semgrep/codeql directly, then import)

Building the code graph itself (use the trailmark skill)

audit augmentation

Source

Repository: https://github.com/trailofbits/skills

audit-augmentation FAQ

What does the audit-augmentation skill do?

> Augments Trailmark code graphs with external audit findings from SARIF static analysis results and weAudit annotation files. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, cross-referencing Semgrep or CodeQL findings with call graph data, or visualizing audit findings in the context of code structure. Importing Semgrep, CodeQL, or other SARIF-producing tool results into a graph Importing weAudit audit annotations into a graph

What does audit-augmentation require?

| "One severity subgraph is enough" | Different severities need different triage workflows | Query all severity subgraphs, not just error |

How do I install audit-augmentation?

Run: npx -y skills add https://github.com/trailofbits/skills --skill audit-augmentation --agent claude-code — the source lives at github.com/trailofbits/skills.

Maintain audit-augmentation?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[audit-augmentation on getagentictools](https://getagentictools.com/skills/trailofbits-skills-audit-augmentation?ref=badge)

npx agentictools info skills/trailofbits-skills-audit-augmentation

The second line is the CLI lookup for this page — handy in READMEs and docs.