Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

trailmark-structural — Claude Code skill: what it does, how to install

Builds a Trailmark graph for a target directory and reports complexity, taint, blast radius, privilege boundaries, and attack surface data.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill trailmark-structural -a claude-code
Open on GitHub

What trailmark-structural does

The skill creates a Trailmark graph for the chosen directory, calls engine.preanalysis(), and returns JSON with detected languages, a summary, pre-analysis results, attack-surface entries, hotspots, and subgraphs. It also reports proxy nodes, privilege boundaries, and taint-related findings.

It checks for trailmark, uses the parsing API to detect supported languages, and retries through uv run --with trailmark if imports fail. Structural analysis is unnecessary overhead for one small file. Trailmark 0.4.0+ adds subgraph edges and type references; 0.5.0+ can include attributes in attack-surface data and proxy nodes from .trailmark/links.toml.

What it helps with

  • build a structural graph for a directory
  • find complexity hotspots
  • assess a node's blast radius
  • inspect privilege boundaries
  • trace taint-related findings

Example prompts for the agent

  • Run Trailmark structural analysis for `./src`.
  • Build the graph and check blast radius for `./target`.
  • Analyze attack surface and hotspots in `./contracts`.

How to install trailmark-structural

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill trailmark-structural -a claude-code

2Manually: put the files in place

~/.claude/skills/trailmark-structural/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/trailmark-structural/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

browser-login ruvnet Authenticates against a site once, sanitizes cookies through AIDefence, vaults the session handle, and lets other skills reuse it without re-logging in. Claude Code CX Codex Cursor +1 729installs iot-witness-verify ruvnet Verifies witness chain integrity for Cognitum Seed devices and detects provenance gaps. Useful for uncovering broken hash chains and missing epochs. Claude Code CX Codex Cursor +1 728installs computer-use-agents sickn33 Guides the architecture of AI agents that control screens, cursors, and keystrokes using Anthropic Computer Use or OpenAI Operator. Useful for sandboxed desktop and GUI automation. Claude Code CX Codex Cursor +1 959installs plaid-fintech sickn33 Provides integration patterns for the Plaid API, covering Link tokens, ACH Auth, transaction sync, balance checks, and webhook handling. Claude Code CX Codex Cursor +1 956installs browser-form-fill ruvnet Fills web forms using a structured JSON field map and saved selector templates. It automates data entry and form submission directly in browser sessions. Claude Code CX Codex Cursor +1 717installs salesforce-component-standards official github Guides Salesforce UI development across LWC, Aura, and Visualforce. Enforces SLDS 2 compliance, accessibility, and platform security. GitHub Copilot 770installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs

Questions about trailmark-structural

How do I install trailmark-structural in Claude Code?

Run npx skills add trailofbits/skills --skill trailmark-structural -a claude-code, then run npx skills add trailofbits/skills --skill trailmark-structural -a claude-code again. The skill file is at ~/.claude/skills/trailmark-structural/SKILL.md.

What does trailmark-structural do?

It runs Trailmark structural analysis for a directory: it builds a graph and gathers complexity, taint, blast-radius, subgraph, and attack-surface data.

Which results depend on the Trailmark version?

Trailmark 0.4.0+ provides subgraph edges and type-reference summaries. In 0.5.0+, attack-surface entries can include attributes, while .trailmark/links.toml can add proxy.external:* nodes.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor