address-sanitizer

An agent skill by trailofbits, from trailofbits/skills. Tags: cli, debugging, security, testing.

What it does

Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill address-sanitizer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.claude/skills/address-sanitizer

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

trailofbits/skills (all skills from this repository)

Path

plugins/testing-handbook-skills/skills/address-sanitizer/SKILL.md

Branch

main

Collection

testing-handbook-skills

Updated

2026-09-19

Related skills

• fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
• modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
• post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
• security-audit — Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons.
• aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
• atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.