trailmark-summary — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trailmark-summary (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Runs trailmark analyze --language auto --summary on a target directory.
trailmark-structural)trailmark skill directly)trailmark-structural)| Rationalization | Why It's Wrong | Required Action |
|---|---|---|
| "I can read the code manually instead" | Manual reading misses parser-based language detection, dependency data, and entry point enumeration | Install and run trailmark |
| "Language detection doesn't matter" | Wrong language selection produces empty or partial analysis | Use Trailmark's parser-based detection or --language auto |
| "Partial output is good enough" | Missing any of the three required outputs (detected languages, entry points, dependencies) means incomplete analysis | Verify all three are present |
| "Tool isn't installed, I'll skip it" | This skill exists specifically to run trailmark | Report the installation gap instead of skipping |
The target directory is passed via the args parameter.
Step 1: Check that trailmark is available.
trailmark analyze --help 2>/dev/null || \
uv run trailmark analyze --help 2>/dev/nullIf neither command works, report "trailmark is not installed" and return. Do NOT run pip install, uv pip install, git clone, or any install command. The user must install trailmark themselves.
Step 2: Detect languages with Trailmark's parse API.
python3 - "{args}" <<'PY'
import json
import sys
from trailmark.parse import detect_languages
print(json.dumps(detect_languages(sys.argv[1])))
PYIf the import fails, rerun the same snippet with uv run python - "{args}". If the result is [], report "Trailmark found no supported languages under target" and return.
Step 3: Run the summary with auto-detection.
trailmark analyze --language auto --summary {args} 2>&1 || \
uv run trailmark analyze --language auto --summary {args} 2>&1Step 4: Verify the output.
The output must include ALL THREE of:
Entrypoints: line from the summary outputDependencies: line from the summary outputIf any are missing, report the gap. Do not fabricate output.
Return the detected language list plus the full Trailmark summary output.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.