trailmark-summary
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, architecture, documentation, trailmark.
What it does
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill trailmark-summaryOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/trailmark/skills/trailmark-summary ~/.claude/skills/trailmark-summarySafety box score
Grade B, low risk: 18 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill runs Trailmark against a target codebase to report detected languages, entry points, and dependencies. The main risks are local command execution and a fallback that may fetch Trailmark via `uv run --with trailmark` if it is not already installed; it does not itself ask for secrets or make filesystem changes.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It shells out to `trailmark analyze --language auto --summary {args}` and also runs embedded Python (`python3 - "{args}" <<'PY'`) to inspect the target. |
| Network access | 2 (moderate) | The fallback `uv run --with trailmark ...` can download Trailmark from a package index if it is missing, which introduces outbound network/package-fetch behavior. |
| Filesystem reach | 1 (low) | It reads the supplied target directory via `detect_languages(sys.argv[1])` and `trailmark analyze ... {args}`, but it does not write or delete files. |
| Secrets & credentials | 0 (none) | No step requests credentials, key files, `.env` data, or browser/session tokens; it only analyzes code structure. |
| Privilege & persistence | 0 (none) | There is no sudo, service registration, shell-startup editing, or global installation step in the skill. |
| Instruction hijack surface | 0 (none) | The text contains procedural guidance and rejection rationales, but nothing that tells the agent to ignore higher-level instructions, hide actions, or follow remote content. |
| Irreversible actions | 0 (none) | The skill only produces a summary and does not push, deploy, post, pay, book, or delete anything. |
| Transparency | 0 (none) | The shipped files are plain text Markdown/YAML/SVG; there are no binaries, minified blobs, or decoded-at-runtime payloads. |
Before installing
- Read `SKILL.md` and confirm you are comfortable with it running `trailmark analyze` plus embedded Python on your chosen target.
- If Trailmark is not installed, expect `uv run --with trailmark` to contact a package index; test this in a scratch environment first.
- Choose a target directory that contains no sensitive material, since the skill will traverse it for language and dependency detection.
Rated 2026-10-16 by an automated review of 3 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/trailmark/skills/trailmark-summary/SKILL.md
- Branch
- main
- Collection
- trailmark
- Updated
- 2026-09-19
Related skills
- diagramming-code — Generates Mermaid diagrams from Trailmark code graphs.
- trailmark — Builds and queries multi-language source and binary code graphs for security analysis.
- trailmark-structural — Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries.
- how — Use for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live".
- domain-modeling — Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
- audit-augmentation — Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files.