address-sanitizer

An agent skill by trailofbits, from trailofbits/skills. Tags: cli, debugging, security, testing.

What it does

Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill address-sanitizer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.claude/skills/address-sanitizer

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation-only and teaches how to build and run C/C++ or Rust targets under AddressSanitizer. The main risk is local execution of the user's test or fuzz targets, plus the recommendation to disable fuzzer memory limits, which can increase resource exhaustion if the target misbehaves.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly instructs the agent to compile and run binaries and fuzzers, e.g. `clang -fsanitize=address -g -o my_program my_program.c`, `./my_program`, `cargo fuzz run`, and `afl-fuzz ... ./fuzz`.
Network access	0 (none)	No commands download data or send data to remote hosts; the only remote references are ordinary documentation links in `SKILL.md`.
Filesystem reach	1 (low)	The skill writes build artifacts and fuzz outputs in the workspace with commands like `-o my_program` and `-o output_dir`, but it does not direct writes outside the project tree.
Secrets & credentials	0 (none)	It does not ask for tokens, passwords, key files, browser sessions, or `.env` contents.
Privilege & persistence	0 (none)	There is no use of `sudo`, global installs, services, scheduled tasks, or shell/OS configuration changes.
Instruction hijack surface	0 (none)	The text does not tell the agent to ignore instructions, hide behavior, or follow remote content; it is straightforward technique guidance.
Irreversible actions	0 (none)	It does not push, post, pay, book, merge, or delete anything; the workflow is limited to local testing.
Transparency	0 (none)	All shipped content is readable text or SVG; there are no binaries, base64 blobs, or downloaded installers.

Before installing

Read the exact commands you plan to use; they will execute the target locally.
Run it only on code you are comfortable fuzzing with `-rss_limit_mb=0` / `-m none` enabled.
Use a disposable workspace if you do not want build artifacts and fuzz outputs in your repo.

Rated 2026-10-21 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/address-sanitizer/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
check-compiler-errors — Run compile and type-check commands and report failures
control-cli — Build or adapt a local harness to drive, inspect, and profile an interactive CLI or TUI without external services.
E2E Testing Nori Skillsets Subcommands — Use when you need to interactively test a nori-skillsets CLI subcommand end-to-end via tmux, with full filesystem isolation