trailmark

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, architecture, security, trailmark.

What it does

Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill trailmark

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/trailmark ~/.claude/skills/trailmark

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

trailofbits/skills (all skills from this repository)

Path

plugins/trailmark/skills/trailmark/SKILL.md

Branch

main

Collection

trailmark

Updated

2026-09-19

Related skills

• trailmark-structural — 5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes.
• audit-augmentation — x binary-analysis graph exports. ).
• graph-evolution — Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes.
• trailmark-finding-triage — Performs graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function.
• trailmark-review-gate — Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths.
• trailmark-summary — Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list.