Skills

trailmark-variant-neighborhood

trailmark-variant-neighborhood is a skill in trailofbits/skills, last changed 16 Sept 2026. It can run shell commands, name web addresses and pre-approve tools — read the findings before installing. Our pattern check found 1 item to review at commit 196a907 on 26 Oct 2026.

Pattern check: 1 item to review · commit 196a907 · 26 Oct 2026

Install
From the author
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
Licence
CC BY-SA 4.0
Repo stars
7.8k
Folder last changed
16 Sept 2026 (opens in a new tab)
Publisher
trailofbits
Files
6 files
Checked
196a907 (opens in a new tab) · 26 Oct 2026

Install

Each tab says whether it installs commit 196a907, the one we checked, or the latest version.

No tab for your agent? Use Any agent for OpenCode, Goose, Windsurf (Devin Desktop), Zed, Roo Code, Factory Droid, Junie, Amp and Antigravity, and Claude Code for Cline. Kiro needs the folder copied by hand.

Pinned to commit 196a907, the one we checked.

From your project's root folder:

tmp="$(mktemp -d)" &&
  git clone -q --depth 1 --filter=blob:none --no-checkout https://github.com/trailofbits/skills.git "$tmp" &&
  git -C "$tmp" fetch -q --depth 1 origin 196a9073ab10d35bacf111f945e02c00b2c6883a &&
  git -C "$tmp" sparse-checkout set -- plugins/trailmark/skills/trailmark-variant-neighborhood &&
  git -C "$tmp" checkout -q 196a9073ab10d35bacf111f945e02c00b2c6883a &&
  mkdir -p .claude/skills &&
  mkdir .claude/skills/trailmark-variant-neighborhood &&
  cp -R "$tmp"/plugins/trailmark/skills/trailmark-variant-neighborhood/. .claude/skills/trailmark-variant-neighborhood/ &&
  rm -rf "$tmp"

If Claude Code was already running and this created the skills folder, run /reload-skills.

Or install the trailmark plugin it ships in. Installs the latest version, not the one we checked. Installs everything in the plugin, including any hooks, MCP servers and scripts our check doesn't cover.

claude plugin marketplace add trailofbits/skills --scope project &&
  claude plugin install trailmark@trailofbits --scope project
Claude Code docs (opens in a new tab)

What it can touch

From the files and frontmatter at commit 196a907. This is how much a skill can do, not whether it is risky.

What it can touch: Shell, network or credentials

  • Runs shell commands

    Its instructions or files give the agent commands to run on your computer.

  • Names web addresses

    It mentions outside web addresses the agent may visit. We list them but don't follow them.

  • Pre-approves tools

    Its allowed-tools field lists tools the agent may use without asking you first, in agents that honour it.

    SKILL.md:5

Pattern check

Pattern check: 1 item to review · commit 196a907 · 26 Oct 2026

We checked every text file in this skill, at commit 196a907 on 26 Oct 2026, against 45 published patterns such as download-and-run commands, hidden text and credential access. We don't run the skill, we don't read the web pages it points to, and we can't judge everything its instructions might lead an agent to do. In published tests, pattern checks like this one missed most malicious skills. Read the skill before you install it — especially anything it asks you to download or run.

How the check worksReport an incorrect finding

Outside links we did not follow

  • http://www.w3.org/2000/svg

Format check

Each agent reads SKILL.md a little differently. We check the file against each one's published rules; we don't run the skill in any agent.

  • Agent Skills specPasses with warnings

    The open format from agentskills.io, held to what the strictest agents enforce, so one folder loads everywhere.

    • Warning

      allowed-tools is a list; the spec defines a space-separated string. gh skill publish rejects a list, though Claude Code accepts one. O5

      Fix: Write it on one line: allowed-tools: Bash Read Grep Glob Write

    • Note

      The first sentence of the description is 322 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

    • Note

      There is no license field, so readers can't tell whether they may reuse the skill. O2

      Fix: Add license: with an SPDX name such as MIT or Apache-2.0, or the name of a bundled licence file.

  • Claude CodePasses

    Claude Code reads its own extra fields, ignores unknown ones, and still loads a skill whose frontmatter is broken, without its fields.

    • Note

      The first sentence of the description is 322 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

  • Claude apps & API uploadPasses

    Uploading to claude.ai or the Claude API, or packaging with Anthropic's script, accepts only the six spec fields and stops on anything else.

    • Note

      The description is 473 characters. The claude.ai Help Center says 200 at most, though Anthropic's API docs and validator allow 1,024. D4

      Fix: If the claude.ai upload refuses it, trim the description to 200 characters.

    • Note

      allowed-tools is a list; the spec defines a space-separated string. O5

      Fix: Write it on one line: allowed-tools: Bash Read Grep Glob Write

  • OpenAI (Codex & API)Passes

    Codex finds SKILL.md by its exact name and needs a description; OpenAI's Skills API checks the frontmatter against the spec and caps uploads.

    • Note

      The first sentence of the description is 322 characters. Agents shorten long descriptions, so lead with the main job. D8

      Fix: Start with one short sentence that names the job.

    • Note

      allowed-tools is a list; the spec defines a space-separated string. O5

      Fix: Write it on one line: allowed-tools: Bash Read Grep Glob Write

  • VS Code & CopilotPasses

    VS Code reads skills one folder below .github/skills, .claude/skills or .agents/skills and falls back to the folder name when the name is missing or differs; GitHub's Copilot docs require the exact name SKILL.md.

    • Note

      allowed-tools is a list; the spec defines a space-separated string. O5

      Fix: Write it on one line: allowed-tools: Bash Read Grep Glob Write

SKILL.md

We only show SKILL.md text here when its licence clearly allows it.

Read SKILL.md on GitHub (opens in a new tab)

Files

6 files

PathSize
SKILL.md (opens in a new tab)4.2 KB
agents/openai.yaml (opens in a new tab)252 B
assets/trail-of-bits-mark.svg (opens in a new tab)3 KB
references/neighborhood-patterns.md (opens in a new tab)2.2 KB
references/output-format.md (opens in a new tab)1.4 KB
references/ranking.md (opens in a new tab)1.6 KB

More from trailofbits/skills

  • address-sanitizer

    trailofbits/skills

    Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.

    Pattern check: Nothing flaggedWhat it can touch: Runs shell commands · Names web addresses

    CC BY-SA 4.0 · 7.8k repo stars · Updated 16 Sept 2026

  • adjudicate-regression

    trailofbits/skills

    Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.

    Pattern check: Nothing flaggedWhat it can touch: Instructions only

    CC BY-SA 4.0 · 7.8k repo stars · Updated 20 Oct 2026

  • aflpp

    trailofbits/skills

    Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.

    Pattern check: Nothing flaggedWhat it can touch: Runs shell commands · Reaches the network +1

    CC BY-SA 4.0 · 7.8k repo stars · Updated 16 Sept 2026

  • agentic-actions-auditor

    trailofbits/skills

    Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.

    Pattern check: Items to reviewWhat it can touch: Touches credentials · Runs shell commands +3

    CC BY-SA 4.0 · 7.8k repo stars · Updated 16 Sept 2026

  • algorand-vulnerability-scanner

    trailofbits/skills

    Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

    Pattern check: Nothing flaggedWhat it can touch: Runs shell commands · Names web addresses

    CC BY-SA 4.0 · 7.8k repo stars · Updated 16 Sept 2026

  • atheris

    trailofbits/skills

    Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.

    Pattern check: Nothing flaggedWhat it can touch: Runs shell commands · Reaches the network +1

    CC BY-SA 4.0 · 7.8k repo stars · Updated 16 Sept 2026

All skills in trailofbits/skills