Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.
Start a fresh conversation. Replace the highlighted placeholders.
Use trailmark-review-gate to compare [before ref] with [after ref] for structural security regressions; return a Trailmark review packet with verdict, exact affected paths, recommended review actions, and stated analysis limitations without modifying the working branch.
Required inputs
[before ref]
[after ref]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: trailmark-review-gatedescription: "Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge."allowed-tools: - Bash - Read - Grep - Glob - Write
Trailmark Review Gate
Apply deterministic security gate rules to Trailmark structural diff evidence.
This skill does not replace line-level review. It produces a compact structural
packet reviewers can cite while they inspect the code.
When to Use
Reviewing a branch, pull request, release diff, or fix commit
Checking whether a change expands attack surface
Looking for removed validation or authorization on reachable paths
Comparing before/after taint, privilege-boundary, blast-radius, or
complexity signals
Producing graph evidence for a differential review
When NOT to Use
Single-snapshot analysis. Use trailmark or trailmark-structural.
Text-diff review only. Use differential-review.
Full vulnerability discovery. Use an audit or bug-finding workflow.
One static finding. Use trailmark-finding-triage.
Tooling is unavailable and the user wants manual review only.
Rationalizations to Reject
Rationalization
Why It Is Wrong
Required Action
"The line diff is small, so no graph gate is needed"
Small changes can create new call paths
Compare before/after graphs
"Graph gate passed, so the PR is secure"
The gate only checks structural regressions
Still perform line-level review
"Trailmark failed, so pass the gate"
Tool failure is unknown risk, not success
Emit UNKNOWN
"Tests pass, so removed validation is fine"
Tests may miss affected entrypoint paths
Review the removed path manually
"Only new code matters"
Removed auth, validation, and callers can be higher risk than additions
Accept two refs, a branch name, a commit range, or before/after directories.
Do not check out branches unnecessarily. Prefer git diff, git show, and
git worktrees, following the graph-evolution snapshot workflow.
Step 2: Build Graph Evidence
Run graph-evolution or equivalent Trailmark before/after graph analysis.
Both snapshots must run engine.preanalysis() so taint, privilege-boundary,
blast-radius, complexity, and entrypoint signals are available.
Record Trailmark version and any feature probes. If graph construction fails,
emit UNKNOWN.