trailmark

Analyze source code for security vulnerabilities using code graphs.

6.5k|561|Updated Jan 14, 2026

Search Tags:#security analysis #vulnerability detection #smart contract #source code #code graph

Ready to run

npx skills add https://github.com/trailofbits/skills --skill trailmark-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: trailmark
Source: https://github.com/trailofbits/skills/tree/main/plugins/trailmark/skills/trailmark
Command: npx skills add https://github.com/trailofbits/skills --skill trailmark-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires trailmark, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the analysis of source code for security vulnerabilities by building and querying multi-language source code graphs.

Core Features & Use Cases

Code Graphs: Builds directed graphs of functions, classes, calls, and metadata for security analysis.
Pre-Analysis Passes: Includes blast radius, taint propagation, privilege boundaries, and entry point enumeration.
Use Case: Ideal for identifying attack surfaces, complexity hotspots, and entry points during security reviews and audits.

Quick Start

Analyze your codebase using Trailmark by running: uv run trailmark analyze --language auto {targetDir}

Frequently Asked Questions about trailmark

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze source code for security vulnerabilities using code graphs?▼

You can analyze source code for security vulnerabilities by constructing and querying multi-language code graphs to map functions, classes, and calls. This approach identifies attack surfaces, complexity hotspots, and entry points during security reviews.

What is source code graph analysis for smart contract auditing?▼

Source code graph analysis for smart contract auditing builds directed graphs of functions, metadata, and calls to identify security vulnerabilities. It applies pre-analysis passes like blast radius and taint propagation to map attack surfaces.

Do I need to install the trailmark package to run security analysis on my codebase?▼

Yes, you need to install the trailmark package to parse source code and perform graph analysis. Once installed, you execute security analysis by running the analyze command against your target directory.

Can I use code graph analysis for taint propagation and blast radius checks?▼

Yes, code graph analysis supports taint propagation and blast radius checks through pre-analysis passes. It enumerates entry points and privilege boundaries to pinpoint attack surfaces and complexity hotspots in source code.

What's the best way to identify attack surfaces and entry points during a code review?▼

The best way to identify attack surfaces and entry points during a code review is by building source code graphs. This method applies pre-analysis passes to reveal blast radius, taint propagation, and privilege boundaries.

Does code graph security analysis work automatically across multiple programming languages?▼

Yes, code graph security analysis works automatically across multiple languages by setting the language parameter to auto. It parses the target directory and constructs directed graphs to detect vulnerabilities without manual language configuration.