fuzzing-obstacles

An agent skill by trailofbits, from trailofbits/skills. Tags: debugging, fuzzing, security, testing.

What it does

Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and avoiding the false positives a patch can introduce. Use when a fuzzer is stuck at validation, when coverage shows large regions behind a checksum, or when valid inputs are impractical to generate.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill fuzzing-obstacles

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.claude/skills/fuzzing-obstacles

Safety box score

Grade A, minimal risk: 4 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation-only fuzzing technique guide. It teaches how to patch target code so fuzzers can bypass validation, checksums, and nondeterministic state during fuzzing builds; it does not ship scripts or installers that touch the host machine.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts, binaries, or code-evaluation steps are shipped; the only commands shown are example build invocations in the markdown.
Network access	0 (none)	The skill does not download or transmit data itself; it only links to external documentation and examples in prose.
Filesystem reach	1 (low)	It is meant to modify the project under test, e.g. the examples show conditional patches like `#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` and `cfg!(fuzzing)`, but there is no indication of writes outside the working tree.
Secrets & credentials	0 (none)	No credential stores, `.env` files, tokens, browser sessions, or login flows are referenced.
Privilege & persistence	0 (none)	There is no sudo, service registration, global install, or OS configuration change in the shipped files.
Instruction hijack surface	0 (none)	The markdown does not try to override instructions, hide content, or fetch and follow remote prompts; it is ordinary technical guidance.
Irreversible actions	0 (none)	It does not push, deploy, post, pay, book, or delete anything; it only describes local fuzzing workflow changes.
Transparency	0 (none)	All shipped files are readable text/SVG; there are no binaries, minified blobs, or decoded-at-runtime payloads.

Before installing

Read `SKILL.md` and confirm you want a technique that deliberately relaxes validation in fuzzing builds.
Check your fuzz target repository for any production code paths that would be affected by `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` or `cfg!(fuzzing)`.
Verify the workflow stays inside the project checkout and does not require sudo or access to secrets.
If you rely on exact production behavior in fuzzing, make sure the skipped checks are limited to test-only build flags.

Rated 2026-10-19 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/fuzzing-obstacles/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
ruzzy — Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language.
post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!