harness-writing

An agent skill by trailofbits, from trailofbits/skills. Tags: code-quality, developer-tools, fuzzing, testing.

What it does

Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes, and deciding what to fuzz together. Use when writing a first LLVMFuzzerTestOneInput or fuzz_target! harness, when a campaign finds nothing or reports crashes that will not reproduce, or when the target API needs structured rather than raw input.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill harness-writing

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/harness-writing ~/.claude/skills/harness-writing

Safety box score

Grade A, minimal risk: 7 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only fuzzing skill for C/C++ and Rust. It does not ship runnable automation or secret-handling code, but it does teach the agent to compile and run fuzzers that execute the project under test and generate local build/corpus artifacts.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill gives runnable fuzzing commands like `clang++ -fsanitize=fuzzer,address -g harness.cc -o fuzz_target`, `afl-fuzz ... -- ./fuzz_target`, and `cargo +nightly fuzz run my_target`, but it ships no executables or downloaded scripts.
Network access	0 (none)	It only links to external documentation and videos; there are no commands that send data off-machine or fetch remote code.
Filesystem reach	1 (low)	It expects harnesses and corpora to be created inside the repository, e.g. `fuzz/fuzz_targets/`, `seeds/`, and `findings/`, but it does not direct edits outside the project tree.
Secrets & credentials	0 (none)	There is no mention of tokens, keys, passwords, browser sessions, `.env` files, or other credential stores.
Privilege & persistence	0 (none)	No sudo, global installs, services, shell startup edits, or OS settings changes are requested.
Instruction hijack surface	0 (none)	The text contains no prompt-injection patterns such as telling the agent to ignore instructions, hide actions, or follow remote content.
Irreversible actions	0 (none)	It does not publish, deploy, pay, message, or delete anything; it is limited to local fuzz-harness work.
Transparency	0 (none)	All shipped files are readable text or SVG; there are no binaries, base64 blobs, or unreviewable installers.

Before installing

Confirm you want a skill that will run fuzzers against your code and intentionally trigger crashes in a local checkout.
Review any harness it creates for blocking I/O or network calls before letting it run long campaigns.
Use a disposable branch or scratch clone so generated corpora, crashes, and build artifacts stay isolated.

Rated 2026-10-17 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/harness-writing/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
libfuzzer — Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.
genotoxic — Graph-informed mutation testing triage.
atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
fuzzing-dictionary — Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects.