CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

graph-evolution

Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable workflow document: executable commands at every phase, explicit validation and error-recovery loops, and correctly wired one-level-deep references. The main weakness is repetition — the language-default pitfall is stated four times and severity details duplicate the report-format reference — which costs token efficiency without adding guidance.

Suggestions

State the trailmark diff --language default pitfall once (in the Diff Reference) and reference it from the Rationalizations table, Phase 3, and the Quality Checklist instead of repeating the full explanation four times.

Replace the empty Quick Start code block with either a minimal three-command quick path or remove the section and let the Decision Tree route directly to the Workflow.

Move the severity-classification table (and interpretation priorities, if duplicated) fully into references/report-format.md and keep only the prioritized one-line list inline, since report-format.md already advertises severity classification in its contents.

DimensionReasoningScore

Conciseness

The body is mostly efficient (tables, commands, terse phases), but the trailmark diff `--language` default pitfall is repeated in four places (Rationalizations table, Phase 3, Diff Reference, Quality Checklist), the intro paragraph restates the frontmatter description nearly verbatim, and the severity-classification table duplicates content that report-format.md's own contents list claims to cover. This goes beyond anchor 4's "minor instances" of over-explanation, fitting anchor 3's "could be tightened".

3 / 5

Actionability

Guidance is fully executable: worktree bash commands with mktemp, a working Python build/export snippet using the trailmark API, fully-flagged diff commands with an install fallback, and argument/output-key tables for graph_diff.py. The only stub is the comment-only Quick Start block, which does not reduce the copy-paste readiness of the actual workflow, so this sits at anchor 5 rather than anchor 4.

5 / 5

Workflow Clarity

Five clearly sequenced phases with a progress checklist, a decision tree for entry points, explicit validation checkpoints (verify both graph summaries, "stop and report the error" on failed/empty diffs, node-count-based disambiguation of empty diffs, language retry guidance), and a pre-delivery Quality Checklist. This matches anchor 5's explicit validation, error-recovery feedback loops, and checklists; anchor 4 is ruled out because no checkpoint is missing.

5 / 5

Progressive Disclosure

Both referenced files (references/evolution-metrics.md, references/report-format.md) and the referenced script (scripts/graph_diff.py) exist, are one level deep, and are well signaled via the Decision Tree, inline links, and a Supporting Documentation section. It falls short of anchor 5 because the inline severity-classification and interpretation-priority tables overlap with report-format.md's stated contents, so some content that should live solely in the reference remains in the overview.

4 / 5

Total

17

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete capabilities, explicit what-and-when structure, and a clearly scoped niche. The trigger list covers the main natural phrasings well, with only minor gaps in synonyms and minor overlap risk against adjacent skills in the same tool family.

DimensionReasoningScore

Specificity

The description lists multiple concrete actions ("Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications") within a clearly scoped domain ("Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories)"). Coverage is comprehensive with no padding, matching the top anchor rather than anchor 4 because no capability area is missing.

5 / 5

Completeness

It explicitly answers both questions: what it does ("Compares Trailmark code graphs at two source code snapshots... to surface security-relevant structural changes") and when to use it, with five concrete trigger phrases in the "Use when..." clause. This mirrors the anchor-5 example pattern exactly, and is above anchor 4 because the "when" half is specific, not merely present.

5 / 5

Trigger Term Quality

The "Use when" clause offers good natural phrasing ("comparing code between commits or tags", "attack surface growth", "what changed between audit snapshots"), but common variations users would naturally say — e.g. "before/after comparison", "release diff", "security diff" — are absent. It exceeds anchor 3 (relevant keywords present) but does not reach anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

The two-snapshot structural-diff niche is distinct and the phrase "that text diffs miss" actively steers away from line-diff skills, but triggers like "comparing code between commits or tags" overlap with closely related sibling skills (single-snapshot trailmark analysis, text-diff review). Minor overlap risk with closely related skills matches anchor 4 rather than anchor 5's "minimal conflict risk".

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

trailofbits/skills

Path

plugins/trailmark/skills/graph-evolution/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.