skills.rest
trailofbits
trailofbitsOFFICIAL
Explore all skills by this author →
Website𝕏@trailofbitsGitHub

slicing-code-context

Builds bounded graph-informed source slices with Trailmark for delegation to constrained subagents.

6.9k|598|Updated Jan 14, 2026
Search Tags:#static analysis#call graph#context budget#subagent delegation#local models#code slicing#Trailmark
One-click install
npx skills add https://github.com/trailofbits/skills --skill slicing-code-context
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: slicing-code-context
Source: https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/slicing-code-context
Command: npx skills add https://github.com/trailofbits/skills --skill slicing-code-context

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, pytest, ruff, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Delegating code analysis to small or locally hosted models usually means either dumping the whole repository into the prompt or hand-picking snippets that miss critical context. This Skill selects bounded, call-graph-informed source slices with Trailmark and packages them into a deterministic packet, so a constrained worker model receives exactly the code it needs and nothing more.

Core Features & Use Cases

  • Graph-informed slicing: Select code by neighborhood, upstream/downstream callers, shortest call paths, or entrypoint-to-target paths using Trailmark's static analysis graph.
  • Deterministic budgeted packets: Emit JSON or Markdown slice packets with a strict estimated-token budget, omission records, and an untrusted-source notice that neutralizes prompt injection inside sliced code.
  • Verified delegation workflow: Delegate the task plus packet to a subagent, validate the worker's JSON response against the packet, and permit at most one focused context expansion.
  • Use Case: Ask a small local model to explain Auth.verify and list its assumptions; the coordinator builds an 8K-token neighborhood packet, passes it verbatim to the worker, and verifies every cited line before accepting the answer.

Quick Start

Ask the assistant to use the slicing-code-context skill to have a small worker model explain a specific function, providing only a bounded Trailmark slice packet of that function and its immediate callers and callees.

Frequently Asked Questions about slicing-code-context

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I delegate code analysis to a small local model without sharing the whole repository?▼

Build a bounded slice packet with the build_slice_packet.py script, which uses Trailmark's call graph to select only the relevant functions and their graph neighborhood. Send the task plus the packet verbatim to the worker model, then validate its JSON response against the packet.

What slicing modes does the Trailmark packet builder support?▼

It supports neighborhood mode for one-hop callers and callees, upstream and downstream modes for transitive call traversal, path mode for shortest call paths between two functions, and entrypoint mode for paths from public entrypoints to a target.

What are the requirements to run the slice packet script?▼

The script requires Python 3.12 or later and resolves Trailmark 0.5.x automatically via uv using PEP 723 inline dependencies. It runs against a target source directory and emits JSON or Markdown packets.

Does the token budget guarantee the worker model's context window fits?▼

No. The budget bounds only the rendered packet using a bytes-divided-by-three estimate, not the worker's system prompt, task text, or output allowance. Reserve extra capacity and lower the explicit limit when the worker model has a small context window.

What happens when a symbol name matches multiple functions?▼

The script raises an ambiguous_symbol error listing candidate node IDs. Re-run it with the exact Trailmark node ID of the intended function rather than picking the first match.

When should I not use bounded slice delegation?▼

Avoid it when the worker must explore the repository itself, when runtime behavior or dynamic dispatch dominates the analysis, or when the task requires the worker to edit files directly. Workers only propose changes; the coordinator validates and applies them.

Related Skills

Explore More Software Engineering Skills→
thethirdoriginthethirdorigin

codegraph

Index and query local codebases as semantic knowledge graphs.

Official
Advanced
YokhanYokhan

update-deps

Audit dependencies, categorize patch/minor/major updates, apply them, run tests, and commit changes.

Community
Advanced
Wanli-LeeWanli-Lee
1

aegis-shield

Scan untrusted text for prompt-injection and data-exfiltration risks before memory writes.

Community
Basic
aquariuscookaquariuscook

QE Code Intelligence

Construct knowledge graphs and enable semantic search for codebases.

Community
Advanced