domains / families / security / audit-augmentation

audit-augmentation

separate

Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.

When to use

• Importing Semgrep, CodeQL, or other SARIF-producing tool results into a graph
• Importing weAudit audit annotations into a graph
• Importing binary-analysis graph data into a source graph (Trailmark 0.4.0+)
• Cross-referencing static analysis findings with blast radius or taint data
• Querying which functions have high-severity findings
• Visualizing audit coverage alongside code structure
• Preparing one SARIF or weAudit result for `trailmark-finding-triage`

When not to use

• Running static analysis tools (use semgrep/codeql directly, then import)
• Building the code graph itself (use the `trailmark` skill)
• Generating diagrams (use the `diagramming-code` skill after augmenting)

Skill page

Source