The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands using uv run to perform version checks (trailmark diagram --help), analyze projects (trailmark analyze), and run the bundled diagramming wrapper (scripts/diagram.py). These commands are essential for the skill's stated purpose of visualizing code architecture.
[EXTERNAL_DOWNLOADS]: The skill documentation includes steps for the agent to install the trailmark package via uv tool install trailmark. This is a vendor-provided dependency required for the core analysis functionality. As trailmark is a recognized resource from the skill's author (trailofbits), this installation is considered a standard operational requirement.
[DYNAMIC_EXECUTION]: The instructions guide the agent to execute a Python code snippet that utilizes the trailmark.query.api.QueryEngine to perform pre-analysis on the target directory. This involves programmatically interacting with the installed analysis library to enrich the code graph with taint and privilege data.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill processes entire source code directories ({targetDir}) provided by the user to build its analysis graph. This is an entry point for untrusted data.
Boundary markers: The output diagrams are delimited within Mermaid code fences. The skill also provides documentation for escaping double quotes in labels to prevent syntax manipulation.
Capability inventory: The skill uses both the trailmark CLI and its Python API to read files, propagate taint information, and generate visual output.
Sanitization: Detailed rules for sanitizing node identifiers and escaping label characters are provided in references/mermaid-syntax.md. However, processing arbitrary code files remains a potential vector for indirect prompt injection if the analysis results or the generated diagrams are manipulated by malicious comments or strings embedded within the target codebase.

diagramming-code