domains / families / security / trailmark-review-gate

trailmark-review-gate

separate

Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.

When to use

• Reviewing a branch, pull request, release diff, or fix commit
• Checking whether a change expands attack surface
• Looking for removed validation or authorization on reachable paths
• Comparing before/after taint, privilege-boundary, blast-radius, or
• Producing graph evidence for a differential review

When not to use

• Single-snapshot analysis. Use `trailmark` or `trailmark-structural`.
• Text-diff review only. Use `differential-review`.
• Full vulnerability discovery. Use an audit or bug-finding workflow.
• One static finding. Use `trailmark-finding-triage`.
• Tooling is unavailable and the user wants manual review only.

Skill page

Source