trailmark

npx skills add trailofbits/skills --skill trailmark --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

# Trailmark Parses source code into a directed graph of functions, classes, calls, and semantic metadata for security analysis. ## When to Use - Mapping call paths from user input to sensitive functions - Finding complexity hotspots for audit prioritization - Identifying attack surface and entrypoints - Understanding call relationships in unfamiliar codebases - Security review or audit preparation across polyglot projects - Adding LLM-inferred annotations (assumptions, preconditions) to code units - Importing external binary-analysis graphs to connect source and binary views - Querying transitive slices, entrypoint paths, subgraph edges, or type references - Producing graph evidence for one suspicious function or candidate finding - Pre-analysis before mutation testing (genotoxic skill) or diagramming ## When NOT to Use - Single-file scripts where call graph adds no value (read the file directly) - Architecture diagrams not derived from code (use the `diagramming-code` skill or draw by hand) - Mutation testing triage (use the genotoxic skill, which calls trailmark internally) - Runtime behavior analysis (trailmark is static, not dynamic) ## Rationalizations to Reject | Rationalizat

uv pip install trailmark
trailmark --version 2>/dev/null || uv run trailmark --version 2>/dev/null
Auto-detect and merge every supported language under the tree
uv run trailmark analyze --language auto --summary {targetDir}
Explicit languages (single language or comma-separated list)
uv run trailmark analyze --language rust {targetDir}
uv run trailmark analyze --language python,rust {targetDir}
Complexity hotspots
uv run trailmark analyze --language auto --complexity 10 {targetDir}
Entrypoint inventory and structural diff (v0.2-safe)