Is graph-evolution safe?
Grade A, 100/100. No meaningful risk found.
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.
Agraph-evolution
plugins/trailmark/skills/graph-evolution100/100 · No meaningful risk foundNo security findings
graph-evolution
plugins/trailmark/skills/graph-evolutionCompares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.
- Content hash
- sha256:c989d4105d5e990773dc2d599dcd2033586d8420f5b1592da2b76447bc015d58
- Files
- 6
- Quality
- 100/100
Security findings
None of the 30 rules matched.
Files in this skill
- SKILL.md13.2 KB
- agents/openai.yaml246 B
- assets/trail-of-bits-mark.svg3.0 KB
- references/evolution-metrics.md5.1 KB
- references/report-format.md4.2 KB
- scripts/graph_diff.py7.7 KB
Questions about graph-evolution
- Is graph-evolution safe to install?
- Our scanner gave graph-evolution grade A (100/100): no meaningful risk found. None of the 30 security rules matched. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install graph-evolution in Claude Code or Codex?
- Run skillhash add github:trailofbits/skills/plugins/trailmark/skills/graph-evolution. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if graph-evolution changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from trailofbits/skills
- A
guidelines-advisor
7.6ktrailofbits/skills
Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.
No security findings - A
secure-workflow-guide
7.6ktrailofbits/skills
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.
No security findings - A
algorand-vulnerability-scanner
7.6ktrailofbits/skills
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
No security findings - A
audit-prep-assistant
7.6ktrailofbits/skills
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.
No security findings - A
cairo-vulnerability-scanner
7.6ktrailofbits/skills
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
No security findings - A
code-maturity-assessor
7.6ktrailofbits/skills
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.
No security findings - A
cosmos-vulnerability-scanner
7.6ktrailofbits/skills
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
No security findings - A
solana-vulnerability-scanner
7.6ktrailofbits/skills
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.
No security findings