coverage-analysis — Skills

What it does

Starting a new fuzzing campaign to establish a baseline

Fuzzer appears to plateau without finding new paths

After harness modifications to verify improvements

When migrating between different fuzzers

Identifying areas requiring dictionary entries or seed inputs

Debugging why certain code paths aren't reached

Fuzzing campaign is actively finding crashes

Requirements & configuration

Fuzzer's internal coverage metrics are sufficient for your needs

Uncovered code blocks: Areas that may need better seed inputs or dictionary entries

libFuzzer uses LLVM's SanitizerCoverage by default for guiding fuzzing, but you need separate instrumentation for generating reports.

| Coverage decreases after harness change | Harness now skips certain code paths | Review harness logic; may need to support more input formats |

| aflpp | Uses edge coverage for feedback; detailed analysis requires separate instrumentation |

Configuration: TARGETFUZZ_TARGETSRC_FILTERLLVM_PROFILE_FILE

coverage analysis

Source

Repository: https://github.com/trailofbits/skills

coverage-analysis FAQ

What does the coverage-analysis skill do?

> Coverage analysis measures code exercised during fuzzing. Use when assessing harness effectiveness or identifying fuzzing blockers. Starting a new fuzzing campaign to establish a baseline Fuzzer appears to plateau without finding new paths

What does coverage-analysis require?

Fuzzer's internal coverage metrics are sufficient for your needs Uncovered code blocks: Areas that may need better seed inputs or dictionary entries libFuzzer uses LLVM's SanitizerCoverage by default for guiding fuzzing, but you need separate instrumentation for generating reports. | Coverage decreases after harness change | Harness now skips certain code paths | Review harness logic; may need to support more input formats | | aflpp | Uses edge coverage for feedback; detailed analysis requires separate instrumentation | Configuration keys: TARGET, FUZZ_TARGET, SRC_FILTER, LLVM_PROFILE_FILE.

How do I install coverage-analysis?

Run: npx -y skills add https://github.com/trailofbits/skills --skill coverage-analysis --agent claude-code — the source lives at github.com/trailofbits/skills.

Maintain coverage-analysis?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[coverage-analysis on getagentictools](https://getagentictools.com/skills/trailofbits-skills-coverage-analysis?ref=badge)

npx agentictools info skills/trailofbits-skills-coverage-analysis

The second line is the CLI lookup for this page — handy in READMEs and docs.