libfuzzer

An agent skill by trailofbits, from trailofbits/skills. Tags: cli, developer-tools, fuzzing, testing.

What it does

Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill libfuzzer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.claude/skills/libfuzzer

Safety box score

Grade C, moderate risk: 35 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill sets up and runs libFuzzer against C/C++ targets, so it will compile code and repeatedly execute the resulting fuzzing binary on the user's machine. The main risks are system package installation, fetching external example code/corpora, and the fact that fuzzing intentionally drives arbitrary target code for long periods.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It compiles and runs fuzzing binaries such as `./fuzz corpus/` and `./fuzz -runs=0 corpus/`, which repeatedly execute the target code as part of the skill's core purpose.
Network access	2 (moderate)	The skill explicitly downloads external artifacts with `curl -O` from SourceForge and GitHub, e.g. the libpng tarball, harness, and dictionary.
Filesystem reach	1 (low)	It writes and manages local fuzzing artifacts like `mkdir corpus/`, `mkdir minimized_corpus/`, and crash files saved as `./crash-...`, but stays within the working directory.
Secrets & credentials	0 (none)	There is no instruction to read or handle tokens, keys, passwords, dotfiles, browser sessions, or other secret stores.
Privilege & persistence	2 (moderate)	Installation examples use package-manager operations such as `apt install clang llvm`, `apt install clang-18 llvm-18`, and `brew install llvm`, which change system-wide software state.
Instruction hijack surface	0 (none)	I did not find prompt-injection style instructions to ignore policies, hide actions, or follow remote instructions; the text is ordinary fuzzing guidance.
Irreversible actions	1 (low)	It starts long-running campaigns like `./fuzz corpus/` and says they run until a crash is found or the user stops them, but it does not autonomously take external side effects such as posting or deleting.
Transparency	1 (low)	Some example inputs and code are fetched from remote URLs rather than bundled locally, so the exact contents are not fully inspectable from the skill repository alone.

Before installing

Confirm you are okay installing Clang/LLVM through your system package manager (`apt`/`brew`).
Review the example `curl` URLs before using them, especially the downloaded harness, corpus, and dictionary files.
Run fuzzing in an isolated workspace or VM; expect crash files and corpus data to be written in the current directory.
If you do not want the agent executing long-running test binaries, do not let it start `./fuzz` campaigns unsupervised.

Rated 2026-10-20 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/libfuzzer/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
fuzzing-dictionary — Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects.
harness-writing — Designs and improves fuzzing harnesses for C/C++ and Rust.
dev-browser — Browser automation with persistent named pages via the dev-browser CLI.
TUI Puppeteering with tmux — Use when automating or testing TUI/CLI applications - provides isolated tmux sessions with scripts for input, output capture, and state verification