Is trailmark-variant-neighborhood safe?
Grade A, 94/100. No meaningful risk found.
Expands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
Atrailmark-variant-neighborhood
plugins/trailmark/skills/trailmark-variant-neighborhood94/100 · No meaningful risk found1 medium
trailmark-variant-neighborhood
plugins/trailmark/skills/trailmark-variant-neighborhoodExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.
- Content hash
- sha256:4e2a1d95cc3ef329ec0d49393c55c5e0679d56d7f4e17a0e899871ba66b0b8d7
- Files
- 6
- Quality
- 100/100
Security findings
- mediumUnrestricted shell accessSL601 · plugins/trailmark/skills/trailmark-variant-neighborhood/SKILL.md:1
Bashallowed-tools grants the skill any shell command without confirmation. Fix: Scope it, for example 'Bash(git status:*)' or 'Bash(npm test)'.
Files in this skill
- SKILL.md4.2 KB
- agents/openai.yaml252 B
- assets/trail-of-bits-mark.svg3.0 KB
- references/neighborhood-patterns.md2.2 KB
- references/output-format.md1.4 KB
- references/ranking.md1.6 KB
Questions about trailmark-variant-neighborhood
- Is trailmark-variant-neighborhood safe to install?
- Our scanner gave trailmark-variant-neighborhood grade A (94/100): no meaningful risk found. It matched 1 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install trailmark-variant-neighborhood in Claude Code or Codex?
- Run skillhash add github:trailofbits/skills/plugins/trailmark/skills/trailmark-variant-neighborhood. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if trailmark-variant-neighborhood changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from trailofbits/skills
- A
guidelines-advisor
7.6ktrailofbits/skills
Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.
No security findings - A
secure-workflow-guide
7.6ktrailofbits/skills
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.
No security findings - A
algorand-vulnerability-scanner
7.6ktrailofbits/skills
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
No security findings - A
audit-prep-assistant
7.6ktrailofbits/skills
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.
No security findings - A
cairo-vulnerability-scanner
7.6ktrailofbits/skills
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
No security findings - A
code-maturity-assessor
7.6ktrailofbits/skills
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.
No security findings - A
cosmos-vulnerability-scanner
7.6ktrailofbits/skills
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
No security findings - A
solana-vulnerability-scanner
7.6ktrailofbits/skills
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.
No security findings