fuzzing-dictionary

An agent skill by trailofbits, from trailofbits/skills. Tags: cli, fuzzing, research, testing.

What it does

Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use when fuzzing a parser, protocol, or file format, when coverage stalls at input validation, or when a target compares against fixed strings.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill fuzzing-dictionary

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.claude/skills/fuzzing-dictionary

Safety box score

Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a fuzzing-technique guide: it helps build dictionary files and wire them into libFuzzer, AFL++, cargo-fuzz, and go-fuzz. The main risk is local execution of compiler/fuzzer commands against a target harness and writing dictionary/corpus files in the workspace; it does not meaningfully expand network, secret, or privilege exposure.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It directs the user to run local commands like `clang++ -fsanitize=fuzzer,address ...`, `afl-fuzz ...`, `cargo fuzz run ...`, and `./fuzz -dict=...`, which execute the target harness and fuzzer tooling.
Network access	0 (none)	There is no command that sends data off-machine or downloads content; the `man curl \| grep ...` example is a local man-page parse, and the GitHub/LLVM links are just references.
Filesystem reach	1 (low)	The examples create and overwrite files in the current workspace, e.g. `> header.dict`, `> strings.dict`, `> auto.dict`, and corpus/output directories like `corpus/` and `out`.
Secrets & credentials	0 (none)	The skill never asks for tokens, passwords, `.env` files, keychains, or logged-in browser/CLI sessions.
Privilege & persistence	0 (none)	No sudo, service installation, shell startup edits, or global system changes are requested.
Instruction hijack surface	0 (none)	It does not tell the agent to ignore instructions, hide actions, or follow remote prompt content; the LLM prompt snippet is just an example for dictionary generation.
Irreversible actions	0 (none)	It does not send messages, deploy, pay, publish, or delete anything; its actions are limited to local fuzzing setup.
Transparency	0 (none)	All shipped files are plain text/SVG and readable; there are no binaries, obfuscated blobs, or runtime-downloaded scripts.

Before installing

Read the command examples and confirm they point only at a scratch harness and disposable output directories.
Check whether your repo already has files named `header.dict`, `strings.dict`, `auto.dict`, `corpus/`, or `output/` that could be overwritten.
If you use the go-fuzz example, make sure the generated `corpus/` directory is not a real project corpus you care about.
No secrets or elevated privileges should be needed; if you see either, stop and review the invocation.

Rated 2026-10-16 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/fuzzing-dictionary/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
libfuzzer — Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.