Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

trailmark — Claude Code skill: what it does, how to install

Builds and inspects multi-language code graphs to trace taint propagation, map attack surfaces, and prioritize security audits.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill trailmark -a claude-code
Open on GitHub

What trailmark does

Trailmark turns source code and binaries into a directed graph connecting functions, classes, and calls. It tracks taint propagation, privilege boundaries, and blast radius across polyglot repositories. The analysis is strictly static. It will not capture runtime behaviour.

Installing the skill alone is not enough, because the underlying CLI must be present via uv tool install trailmark. A tool install provides the binary without exposing the library to Python; running scripts requires uv run --with trailmark python -. Graph edge slicing and binary augmentation need version 0.4.0 or newer, while SQL schema parsing and .trailmark/links.toml links arrive in 0.5.0.

What it helps with

  • trace call paths from untrusted input to sensitive internal functions
  • map attack surfaces and enumerate entry points across polyglot codebases
  • measure blast radius and complexity hotspots for audit triage
  • augment code graphs with findings from SARIF or weAudit

Example prompts for the agent

  • Map all call paths from public API endpoints to sensitive database queries.
  • Identify complexity hotspots and tainted paths before starting the code audit.
  • Import our SARIF security findings and overlay them onto the project call graph.

How to install trailmark

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark -a claude-code

2Manually: put the files in place

~/.claude/skills/trailmark/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/trailmark/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

dependency-check ruvnet Scans project dependencies for known vulnerabilities and CVEs. Run before releases, after lockfile changes, or when investigating security advisories. Claude Code CX Codex Cursor +1 748installs mantis-plan official google Generates a targeted security review plan based on your threat model and historical findings. Run at the start of a review campaign to map code boundaries and prioritize what to check. Claude Code CX Codex Cursor +1 1,600installs mantis-summarize official google Builds a security-focused codebase map with mantis-summary.md files in each directory. Reduces token overhead during planning and research. Claude Code CX Codex Cursor +1 1,600installs anti-detect-browser antibrow Launch Chromium with a genuine device fingerprint through Playwright API. Each profile gets one coherent identity that persists across runs for testing, scraping, and multi-account work. Claude Code CX Codex Cursor +1 136,100installs safety-scan ruvnet Scans inputs for prompt injection, jailbreak attempts, and unsafe content before processing. Use it when handling untrusted data from users, APIs, or webhooks. Claude Code CX Codex Cursor +1 743installs wasm-agent ruvnet Creates and manages isolated WebAssembly agents for running untrusted code safely without host filesystem access. Claude Code CX Codex Cursor +1 739installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about trailmark

How do I install trailmark in Claude Code?

Run npx skills add trailofbits/skills --skill trailmark -a claude-code. You also need the analyzer CLI installed on your system via uv tool install trailmark.

What does trailmark do?

It parses source code and binaries into directed graphs to trace attack paths, entry points, and taint propagation. The skill also computes blast radius and links multi-language components.

Why does Python fail to import trailmark after installation?

A CLI install via uv tool install only installs the binary and does not expose the Python package. Execute Python snippets using uv run --with trailmark python -.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor