blog.trailofbits.com· Apr 23, 2026

Trailmark turns code into graphs

Open Original Article ↗
We’re open-sourcing Trailmark, a library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, then exposes that graph through a Python API that Claude skills can call directly. Install it now: uv pip install trailmark “Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win.” John Lambert’s widely cited observation about network security applies just as well to AI-assisted software analysis. When
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.