diagramming-code
Generates Mermaid diagrams from Trailmark code graphs.
Skill by trailofbits
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/trailofbits-diagramming-code
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: data
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
- Runs as
- Python package
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/diagramming-code
What's inside
- Skill name
diagramming-code- Description
- Generates Mermaid diagrams from Trailmark code graphs. Produces call graphs, class hierarchies, module dependency maps, containment diagrams, complexity heatmaps, and attack surface data flow visualizations. Use when visualizing code architecture, drawing call graphs, generating class diagrams, creating dependency maps, producing complexity heatmaps, or visualizing data flow and attack surface paths as Mermaid diagrams.
- License
- CC-BY-SA-4.0
- Instructions
- 196 lines in SKILL.md · view on GitHub
Before installing
- Ships executable scripts
Files (7)
- SKILL.md
- openai.yaml · agents/
- trail-of-bits-mark.svg · assets/
- diagram-types.md · references/
- mermaid-syntax.md · references/
- diagram.py · scripts/
- test_skill_commands.py · scripts/
SKILL.md (first lines)
# Diagramming Code
Generates Mermaid diagrams from Trailmark's code graph. A pre-made script
handles Mermaid syntax generation; Claude selects the diagram type and
parameters. Trailmark 0.4.0 includes a native `trailmark diagram` command; use
it only after a version/command check, otherwise use this skill's bundled
script.
## When to Use
- Visualizing call paths between functions
- Drawing class inheritance hierarchies
- Mapping module import dependencies
- Showing class structure with members
- Highlighting complexity hotspots with color coding
- Tracing data flow from entrypoints to sensitive functions
## When NOT to Use
- Querying the graph without visualization (use the `trailmark` skill)
- Mutation testing triage (use the `genotoxic` skill)
- Architecture diagrams not derived from code (draw by hand)
## Prerequisites
**trailmark** must be installed. If `uv run trailmark` fails, run:
```bash
uv tool install trailmark
# Python snippets: uv run --with trailmark python - (a tool env is not importable)
```
**DO NOT** fall back to hand-writing Mermaid from source code reading. The
script uses Trailmark's parsed graph for accuracy. If installation fails,
report the error to the user.
## Version Gate
Check whether native v0.4 diagram support exists:
```bash
trailmark diagram --help 2>/dev/null || uv run trailmark diagram --help 2>/dev/null
```
If this succeeds, you may use `trailmark diagram`. If it fails, use
`uv run {baseDir}/scripts/diagram.py`, which keeps the older skill workflow
intact. Do not assume the native CLI exists on Trailmark 0.2.x.
---
## Quick Start
```bash
uv run {baseDir}/scripts/diagram.py \
--target {targetDir} --language auto --type call-graph \
--focus <function> --depth 2
# Trailmark 0.4.0+ equivalent after the Version Gate succeeds
uv run trailmark diagram \
--target {targetDir} --language auto --type call-graph \
--focus <function> --depth 2
```
Output is raw Mermaid text. Wrap in a fenced code block:
````markdown
```mermaid
flowchart TB
...
```
````
---
## Diagram Types
```
├─ "Who calls what?" → --type call-graph
├─ "Class inheritance?" → --type class-hierarchy
├─ "Module dependencies?" → --type module-deps
├─ "Class members and structure?" → --type containment
├─ "Where is complexity highest?" → --type complexity
└─ "Path from input to function?" → --type data-flow
```
For detailed examples of each type, see
[references/diagram-types.md](references/diagram-types.md).
---
## Workflow
```
Diagram Progress:
- [ ] Step 1: Verify trailmark is installed
- [ ] Step 2: Identify diagram type from user request
- [ ] Step 3: Determine focus node and parameters
- [ ] Step 4: Run diagram.py script (or native trailmark diagram on v0.4+)
- [ ] Step 5: Verify output is non-empty and well-formed
- [ ] Step 6: Embed diagram in response
```
**Step 1:** Run `uv run trailmark analyze --language auto --summary {targetDir}`. Install
if it fails. Do not run `engine.preanalysis()` for a diagram: the diagram
command builds its own graph and does not use pre-analysis data, so every
diagram type is identical with or without it. `data-flow` uses the
entrypoints Trailmark records while parsing.
If auto-detection is wrong for the target, rerun with an explicit language or
comma-separated list such as `python,rust`.
**Step 2:** Match the user's request to a `--type` using the decision tree
above.
**Step 3:** For `call-graph` and `data-flow`, identify the focus function.
Default `--depth 2`. Use `--direction LR` for dependency flows.
**Step 4:** Run the script and capture stdout.
If the native v0.4 CLI is available, either command is acceptable; prefer theFrom trailofbits/skills, CC-BY-SA-4.0.
More from trailofbits/skills
- 0.767score
trailmark
trailofbits
Builds and queries multi-language source and binary code graphs for security analysis.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
mermaid-to-proverif
trailofbits
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files).
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
semgrep
trailofbits
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset…
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
slicing-code-context
trailofbits
Selects bounded, graph-informed source slices with Trailmark and delegates focused code analysis or patch-proposal work to a smaller subagent.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
github-triage
trailofbits
Triages a repository's open GitHub issues and pull requests via the gh CLI.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
firebase-apk-scanner
trailofbits
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
dimensional-analysis
trailofbits
Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value.
SkillAFreshness: A★ 7.8KClaude Code - 0.767score
let-fate-decide
trailofbits
Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
codeql
trailofbits
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
interpreting-culture-index
trailofbits
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
entry-point-analyzer
trailofbits
Analyzes smart contract codebases to identify state-changing entry points for security auditing.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
yara-rule-authoring
trailofbits
Guides authoring of high-quality YARA-X detection rules for malware identification.
SkillAFreshness: A★ 7.8KClaude Code +9
Signals
- Stars
- 7,783
- Forks
- 671
- Open issues
- 30
- Last commit (this folder)
- Oct 14, 2026 (13 days ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- CC-BY-SA-4.0
- Repository
- github.com/trailofbits/skills
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from trailofbits
- 0.767score
github-triage
trailofbits
Triages a repository's open GitHub issues and pull requests via the gh CLI.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
entry-point-analyzer
trailofbits
Analyzes smart contract codebases to identify state-changing entry points for security auditing.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
interpreting-culture-index
trailofbits
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
firebase-apk-scanner
trailofbits
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions.
SkillAFreshness: A★ 7.8KClaude Code +9 - 0.767score
dimensional-analysis
trailofbits
Audits code for unit and decimal-scaling bugs and annotates it with dimensional comments recording the units of each value.
SkillAFreshness: A★ 7.8KClaude Code - 0.767score
let-fate-decide
trailofbits
Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated.
SkillAFreshness: A★ 7.8KClaude Code +9
Cite this page
diagramming-code skill. Agent Mart. https://agentmart.dev/skills/trailofbits-diagramming-code (last updated 2026-10-24)