Trailmark Structural
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`...
Install
npx skills add trailofbits/skills --skill trailmark-structural -g -a claude-code -y- Repository
- trailofbits/skills7.9k
- Category
- Engineering
- Updated
- 7d ago
- License
- CC-BY-SA-4.0
- Context cost
- Lightabout 1,406 tokens
- Runs scripts
- No, instructions only
What it does
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.
Trailmark Structural Analysis
Builds a Trailmark graph and runs engine.preanalysis() to compute all
four pre-analysis passes. The core workflow is v0.2-safe; v0.4-only details
are included only after checking method availability, and newer builds
enrich the same output (0.5.0+ adds an attributes key to attack-surface
entries and proxy.external:* nodes from .trailmark/links.toml) without
any workflow change.
When to Use
- Vivisect Phase 1 needs full structural data (hotspots, taint, blast radius, privilege boundaries)
- Detailed pre-analysis passes for a specific target scope
- Generating complexity and taint data for audit prioritization
- Inspecting proxy/unresolved-call counts, subgraph edges, or type-reference summaries when Trailmark 0.4.0+ is installed
When NOT to Use
- Quick overview only (use
trailmark-summaryinstead) - Ad-hoc code graph queries (use the main
trailmarkskill directly) - Target is a single small file where structural analysis adds no value
Rationalizations to Reject
| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "Summary analysis is enough" | Summary skips taint, blast radius, and privilege boundary data | Run full structural analysis when detailed data is needed |
| "One pass is sufficient" | Passes cross-reference each other, taint without blast radius misses critical nodes | Run all four passes |
| "Tool isn't installed, I'll analyze manually" | Manual analysis misses what tooling catches | Report "trailmark is not installed" and return |
| "Empty pass output means the pass failed" | Some passes produce no data for some codebases (e.g., no privilege boundaries) | Return full output regardless |
| "A v0.4 field is always present" | Users may still have Trailmark 0.2.x installed | Probe with hasattr() before querying v0.4-only methods |
Usage
The target directory is passed via the args parameter.
