---
title: "Trailmark - Air Market"
description: "On a big or mixed-language codebase it is hard to know what reaches what. This builds a map of how the code connects and lets you ask questions of it: where input flows, what a function can reach, wh…"
canonical: "https://airmarket.ai/app/trailmark"
---

[Air Market](/) / [Developer Tools](/category/devtools) / Trailmark

Skill by [Trail of Bits](/@trailofbits)

# Trailmark

See how code actually connects before you decide where to look

## What this does

On a big or mixed-language codebase it is hard to know what reaches what. This builds a map of how the code connects and lets you ask questions of it: where input flows, what a function can reach, what crosses a privilege line. Reach for it when you need to decide what deserves your attention in an audit.

### Top 3 things it does for you

- Map the attack surface of this codebase
- Trace where untrusted input can travel
- Show me what a change would affect

## Information

**Trailmark at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Trail of Bits](/@trailofbits) |
| Category | [Developer Tools](/category/devtools) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 34 KB |
| Licence | CC-BY-SA-4.0 |
| Repository | [trailofbits/skills](https://github.com/trailofbits/skills/tree/09dfbd91537b888136c9203dca4ffdee5a595c69/plugins/trailmark/skills/trailmark) |
| GitHub stars | 6,823 (as of Nov 2026) |
| Installs | 4,384, counted by skills.sh (Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Trailmark and flagged nothing. AIR's verdict: **safe**.

**What Trailmark's check was run against**

|  |  |
| --- | --- |
| Commit | 09dfbd91537b888136c9203dca4ffdee5a595c69 |
| Content hash | ea6b53e0fd59146375693ccde63e3d8b7b182636fe786ca9473328d54c6c8176 |
| Files read | [Browse the files at this exact commit](https://github.com/trailofbits/skills/blob/09dfbd91537b888136c9203dca4ffdee5a595c69/plugins/trailmark/skills/trailmark/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Trailmark](/security/trailmark)

## About Trailmark

This builds and queries code graphs across multiple languages, for both source and binaries, so you can ask structural questions about a system rather than reading it file by file.

Its pre-analysis passes cover blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy and unresolved-call tracking, type and reference queries, structural traversal, and graph diffs. It can also augment an audit by importing SARIF, weAudit, and binary findings, and handles SQL schema graphs.

Use it when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint, measuring blast radius, or building a graph to prioritise audit work. Cross-language, FFI, and external links can be declared, and language detection can be left to it when the target is unknown or polyglot.

## What's inside

- SKILL.md - instructions
- agents/openai.yaml - data
- assets/trail-of-bits-mark.svg - template
- references/preanalysis-passes.md - reference
- references/query-patterns.md - reference

## Questions

### Is Trailmark safe to install?

AIR scanned this exact version of Trailmark and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 09dfbd91537b, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/trailmark.

### How do I install Trailmark?

Open https://airmarket.ai/app/trailmark on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/trailofbits/skills/tree/09dfbd91537b888136c9203dca4ffdee5a595c69/plugins/trailmark/skills/trailmark. Install from that link, not the branch.

## Related on Air Market

- [More Developer Tools listings](/category/devtools)
- [Everything by Trail of Bits](/@trailofbits)

---

Canonical URL: <https://airmarket.ai/app/trailmark>