coverage-analysis

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, cli, performance, testing.

What it does

Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill coverage-analysis

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.claude/skills/coverage-analysis

Safety box score

Grade C, moderate risk: 32 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation-and-workflow guide for fuzzing coverage analysis, but it includes many shell commands that build, run, and report on instrumented binaries. The main risks are user-local tool installation, PATH changes, and running coverage jobs against potentially crashing corpora; it does not itself contain opaque binaries or remote-deploy behavior.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill repeatedly instructs the user to run shell commands and instrumented binaries, e.g. `LLVM_PROFILE_FILE=fuzz.profraw ./fuzz_exec corpus/`, `cargo +nightly fuzz coverage fuzz_target_1`, and `chmod +x ./generate_html`.
Network access	2 (moderate)	It requires downloading tools and components from external registries via `rustup toolchain install nightly --component llvm-tools-preview` and `cargo install cargo-binutils rustfilt`, which can fetch code and metadata over the network.
Filesystem reach	2 (moderate)	It writes helper scripts and coverage artifacts in the working directory (`cat <<'EOF' > ./generate_html`, `fuzz.profraw`, `fuzz_html/`, `coverage.html`) and also references the home tree with `export PATH="$HOME/.local/bin:$PATH"`.
Secrets & credentials	0 (none)	The skill does not read, write, or request tokens, keys, passwords, `.env` files, browser sessions, or other credential stores.
Privilege & persistence	2 (moderate)	It performs user-level installs and shell-environment changes (`cargo install cargo-binutils rustfilt`, `export PATH="$HOME/.local/bin:$PATH"`), which modify the account’s toolchain and PATH even though it does not use sudo.
Instruction hijack surface	0 (none)	There is no instruction to skip confirmations, hide actions, follow remote instructions, or override safety rules; the markdown is straightforward coverage documentation.
Irreversible actions	0 (none)	The skill analyzes coverage and suggests manual follow-up work; it does not publish, deploy, send messages, pay, or delete anything on its own.
Transparency	0 (none)	The shipped files are readable text and SVG source; there are no binaries, encoded payloads, or code fetched and executed at runtime inside the skill itself.

Before installing

Confirm you are okay installing Rust tools into your user account with `cargo install cargo-binutils rustfilt`.
Check whether adding `~/.local/bin` to PATH is acceptable in your shell session.
Read the `generate_html` snippet before running it; it will write `./generate_html` and mark it executable.
Use a scratch build directory first, since the workflow creates `.profraw`, `.profdata`, `.gcda`, and HTML report files.

Rated 2026-10-20 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/coverage-analysis/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

seo-unlighthouse — Multi-page Lighthouse audit via the MIT-licensed Unlighthouse CLI.
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
fuzzing-dictionary — Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects.