trailmark-finding-triage

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Trailmark Finding Triage

Trailmark 漏洞分类处理

Build a concise graph evidence packet for one candidate finding. This skill answers whether the affected code is reachable, what graph evidence supports or weakens the claim, and what manual review is still required before calling the issue exploitable.

为单个候选漏洞构建简洁的图谱证据包。该技能可回答受影响代码是否可被访问、哪些图谱证据支持或削弱漏洞可利用性的判断，以及在认定漏洞可被利用前仍需进行哪些人工审查。

When to Use

适用场景

Triage one static-analysis result before spending PoC time
Check whether a manual finding is entrypoint-reachable
Build an evidence packet for PoC work
Review a single suspicious function discovered during manual audit
Decide whether one issue should be promoted, deprioritized, or treated as part of a broader chain analysis

在投入PoC编写时间前，对单个静态分析结果进行分类处理
检查人工发现的漏洞是否可从入口点访问
为PoC编写工作构建证据包
审查人工审计过程中发现的单个可疑函数
决定某一漏洞是否应升级优先级、降低优先级，或作为更广泛链分析的一部分

When NOT to Use

不适用场景

Multiple weak findings might compose into a stronger chain. Use a chain or composition workflow instead.
The user wants a full audit. Use an audit or design-review workflow instead.
The user wants remediation verification for a known finding. Use a remediation-review workflow instead.
The target is a PR or branch diff. Use
```
graph-evolution
```
plus a differential review workflow.
No concrete finding, function, file/line, or suspicious sink exists yet. Use discovery skills first.

多个低危漏洞可能组合成高危漏洞链。此时应使用链分析或组合分析工作流。
用户需要完整审计。此时应使用审计或设计审查工作流。
用户需要对已知漏洞进行修复验证。此时应使用修复审查工作流。
分析目标是PR或分支差异。此时应使用
```
graph-evolution
```
结合差异审查工作流。
尚未确定具体漏洞、函数、文件/行或可疑 sink。此时应先使用发现类技能。

Rationalizations to Reject

需摒弃的错误判断逻辑

Rationalization	Why It Is Wrong	Required Action
"The scanner says high severity, so reachability is obvious"	Static findings need graph and code context before promotion	Bind the finding to a graph node and check entrypoint paths
"No entrypoint path means impossible"	It may mean parser, proxy, or dynamic dispatch limitations	Report the limitation separately from reachability
"An auth check appears on the path, so the issue is safe"	The check may enforce the wrong predicate or be bypassed by another path	Treat validation/auth as review targets, not proof
"One reachable path is enough for a PoC claim"	The path still needs attacker-controlled inputs and compatible preconditions	Separate graph reachability from exploitability
"This is probably a chain"	Single-finding triage stops at one candidate	Hand off related findings to a composition workflow

错误逻辑	问题所在	必要操作
"扫描器显示高风险，所以可达性显而易见"	静态分析结果在升级优先级前需要结合图谱和代码上下文	将漏洞绑定到图谱节点并检查入口路径
"没有入口路径意味着漏洞不可能被利用"	这可能是解析器、代理或动态调度的限制导致的	将该限制与可达性分析结果分开报告
"路径上存在权限检查，所以漏洞是安全的"	该检查可能执行了错误的断言，或可通过其他路径绕过	将验证/权限检查视为审查目标，而非安全证明
"只要有一条可达路径就可以认定漏洞可编写PoC"	该路径仍需要攻击者可控输入和兼容的前置条件	将图谱可达性与漏洞可利用性分开判断
"这可能是一个漏洞链"	单个漏洞分类处理仅针对一个候选漏洞	将相关漏洞移交至组合分析工作流

Workflow

工作流

Finding Triage Progress:
- [ ] Step 1: Normalize the candidate
- [ ] Step 2: Build or reuse the Trailmark graph
- [ ] Step 3: Bind the candidate to graph node(s)
- [ ] Step 4: Analyze reachability, taint, boundaries, and blast radius
- [ ] Step 5: Decide and emit the evidence packet

漏洞分类处理进度:
- [ ] 步骤1: 标准化候选漏洞信息
- [ ] 步骤2: 构建或复用Trailmark图谱
- [ ] 步骤3: 将候选漏洞绑定到图谱节点
- [ ] 步骤4: 分析可达性、污点、边界及影响范围
- [ ] 步骤5: 给出结论并生成证据包

Step 1: Normalize the Candidate

步骤1: 标准化候选漏洞信息

Accept file/line, function name, SARIF result, weAudit annotation, Markdown finding excerpt, or a manual claim. Normalize it to:

title
source type
file path and line range if present
function or node hint
suspected source, sink, or asset
claimed impact

If there is no concrete code anchor, stop and ask for one.

For input handling details, see references/input-normalization.md.

接受文件/行号、函数名、SARIF结果、weAudit标注、Markdown漏洞片段或人工声明。将其标准化为以下内容：

标题
来源类型
文件路径和行范围（若存在）
函数或节点提示
疑似源点、sink或资产
声称的影响

如果没有具体的代码锚点，停止操作并请求提供。

有关输入处理的详细信息，请参阅 references/input-normalization.md。

Step 2: Build Or Reuse The Graph

步骤2: 构建或复用Trailmark图谱

Use the public

trailmark

skill workflow. Prefer an existing fresh exported graph or

.trailmark/

artifact when present. Otherwise build a graph with

language="auto"

or the target's explicit language list, then run

engine.preanalysis()

Record the Trailmark version or feature probes used. Feature-gate Trailmark 0.4-only APIs with

hasattr()

or CLI help checks.

使用公开的

trailmark

技能工作流。若存在已导出的最新图谱或

.trailmark/

工件，优先复用。否则，使用

language="auto"

或目标的明确语言列表构建图谱，然后运行

engine.preanalysis()

。

记录使用的Trailmark版本或功能探针。通过

hasattr()

或CLI帮助检查，对仅Trailmark 0.4支持的API进行功能 gate 控制。

Step 3: Bind The Candidate

步骤3: 绑定候选漏洞

Bind by file and line overlap first, then function name plus file. If several nodes match, list every candidate and select the narrowest enclosing node as primary. If no node matches, report a binding limitation instead of guessing.

SARIF and weAudit users should reuse the

audit-augmentation

workflow for matching and then inspect the annotated node.

首先按文件和行重叠进行绑定，然后按函数名加文件进行绑定。若有多个节点匹配，列出所有候选节点并选择最窄的包含节点作为主节点。若无匹配节点，报告绑定限制而非猜测。

SARIF和weAudit用户应复用

audit-augmentation

工作流进行匹配，然后检查标注的节点。

Step 4: Analyze Graph Evidence

步骤4: 分析图谱证据

Run the query recipe in references/query-recipes.md:

entrypoint paths to the bound node
trust level of each path when available

membership in

tainted

privilege_boundary

, and

high_blast_radius

subgraphs

direct callers and callees
high-impact downstream sinks
sibling or nearby nodes worth manual review

Do not treat graph reachability as proof of exploitability.

运行 references/query-recipes.md中的查询方案：

绑定节点的入口路径
每条路径的信任级别（若可用）

是否属于

tainted

、

privilege_boundary

和

high_blast_radius

子图谱

直接调用者和被调用者
高影响的下游sink
值得人工审查的同级或邻近节点

请勿将图谱可达性视为漏洞可利用性的证明。

Step 5: Decide And Handoff

步骤5: 给出结论并移交

Produce one verdict:

Verdict	Meaning
`Promote`	Graph evidence supports reachability and plausible impact
`Needs manual review`	Evidence is suggestive but not decisive
`Deprioritize`	No reachable path or only trusted/internal paths found
`Blocked`	Binding or Trailmark analysis failed

Write the evidence packet using references/output-format.md.

Hand off promoted PoC-worthy issues to the user's PoC workflow. Hand off related findings to a composition workflow. Hand off repeatable root causes to

trailmark-variant-neighborhood

variant-analysis

, or a custom Semgrep/CodeQL rule workflow.

生成以下结论之一：

结论	含义
`Promote`	图谱证据支持漏洞可达性且具备合理影响
`Needs manual review`	证据具有提示性但非决定性
`Deprioritize`	未发现可达路径，仅找到可信/内部路径
`Blocked`	绑定或Trailmark分析失败

使用 references/output-format.md编写证据包。

将值得编写PoC的升级优先级漏洞移交至用户的PoC工作流。将相关漏洞移交至组合分析工作流。将可重复出现的根本原因移交至

trailmark-variant-neighborhood

、

variant-analysis

或自定义Semgrep/CodeQL规则工作流。

Example Prompts

示例提示

"Use Trailmark finding triage on
```
src/Vault.sol:148
```
; I think withdraw can bypass the balance update."
"Triage this SARIF result before I spend PoC time:
```
semgrep:error unchecked-transfer
```
in
```
contracts/Bridge.sol
```
line 91."
"This report excerpt claims
```
parse_packet
```
is attacker reachable. Build the Trailmark evidence packet and tell me what is still missing."

"对
```
src/Vault.sol:148
```
执行Trailmark漏洞分类处理；我认为withdraw函数可以绕过余额更新检查。"
"在我投入PoC编写时间前，帮我分类处理这个SARIF结果：
```
semgrep:error unchecked-transfer
```
位于
```
contracts/Bridge.sol
```
第91行。"
"这份报告片段声称
```
parse_packet
```
可被攻击者访问。帮我构建Trailmark证据包并告诉我还缺少哪些信息。"