crypto-protocol-diagram

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, crypto, diagrams, documentation.

What it does

Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagrams with cryptographic annotations. Use when diagramming a crypto protocol, visualizing a handshake or key exchange flow, extracting message flow from a spec or RFC, diagramming a ProVerif or Tamarin model, or drawing sequence diagrams for TLS, Noise, Signal, X3DH, Double Ratchet, FROST, DH, or ECDH protocols.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill crypto-protocol-diagram

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/crypto-protocol-diagram ~/.claude/skills/crypto-protocol-diagram

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill reads protocol source or spec text, may fetch URL specs, and writes a Mermaid/Markdown diagram into the workspace. The main risks are limited file writes and outbound fetches; it does not request sudo, touch secret stores, or ship opaque executables.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It can invoke shell tooling (`Tools used: Read, Write, Grep, Glob, Bash, WebFetch`), but it ships no executable scripts and only describes read/grep/write-style analysis.
Network access	1 (low)	It may fetch remote specs when given a URL (`URL provided → fetch with WebFetch`), but it does not send local data to external hosts.
Filesystem reach	1 (low)	It writes a diagram file (`Write the diagram to a file`) and reads project files, but the scope is the working tree rather than system paths.
Secrets & credentials	0 (none)	No file accesses tokens, keychains, browser sessions, or `.env` files; the only scan hit is example text (`SessionID`) in a parsing guide, not credential handling.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, shell startup editing, or OS-setting change in the skill.
Instruction hijack surface	0 (none)	The guidance is workflow-oriented and does not tell the agent to ignore higher-priority instructions, hide behavior, or follow remote instructions.
Irreversible actions	0 (none)	The skill only generates diagrams; it does not post, publish, pay, book, delete, or force-push anything.
Transparency	0 (none)	All reviewed files are plain text (Markdown/YAML/SVG/Python config); there are no binaries, base64 blobs, or unpinned installers.

Before installing

Check `SKILL.md` and confirm you are comfortable with WebFetch for URL-based specs.
Verify the output filename it chooses will not collide with an existing file in your working tree.
If you plan to use remote specs, test once with a non-sensitive URL first.

Rated 2026-10-20 by an automated review of 10 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/trailmark/skills/crypto-protocol-diagram/SKILL.md
Branch: main
Collection: trailmark
Updated: 2026-09-19

diagramming-code — Generates Mermaid diagrams from Trailmark code graphs.
mermaid-to-proverif — Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif.
trailmark-summary — Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list.
vector-forge — Mutation-driven test vector generation.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.