address-sanitizer — Claude Code skill: what it does, how to install
This skill gives an agent a routine for building code with -fsanitize=address, reading ASan reports and freeing the fuzzer from memory caps. Aimed at C/C++ and Rust with unsafe blocks.
npx skills add trailofbits/skills --skill address-sanitizer -a claude-codeWhat address-sanitizer does
The skill walks an agent through an AddressSanitizer build: compile with -fsanitize=address plus -g, set ASAN_OPTIONS, then read the report to find the overflow or the read after free. It ships a step-by-step procedure, a short table of options (verbosity, abort_on_error, detect_leaks) and separate notes for libFuzzer, AFL++ and cargo-fuzz.
ASan reserves around 20TB of virtual address space, so the fuzzer's memory cap has to go: -rss_limit_mb=0 under libFuzzer, -m none under AFL++. Leave the cap in place and the runner kills the process at startup, which reads like a crash in your own code. Rust goes through --sanitizer=address in cargo fuzz.
Expect the build to run about 2-4 times slower. Windows support is experimental, macOS partial. Production is the wrong place for such a binary: it is slower and not safer, so keep it for tests and fuzzing runs. Pure Go or Java gains little here.
What it helps with
- build a C or C++ target under
-fsanitize=address - read an ASan stack trace down to the offending line
- stop a fuzzer from dying on ASan's virtual memory demand
- turn on leak detection for a unit test suite
- add ASan to a Rust crate that leans on unsafe blocks
Example prompts for the agent
- Build
harness.ccwith-fsanitize=fuzzer,address -gand run it with-rss_limit_mb=0 - Here is the ASan report — which line is the use-after-free on?
- Add
--sanitizer=addressto our cargo-fuzz target and check what the leak report says
How to install address-sanitizer
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill address-sanitizer -a claude-code2Manually: put the files in place
~/.claude/skills/address-sanitizer/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/address-sanitizer/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill address-sanitizer -a codex2Manually: put the files in place
.agents/skills/address-sanitizer/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill address-sanitizer -a cursor2Manually: put the files in place
.cursor/skills/address-sanitizer/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills address-sanitizer2Manually: put the files in place
.github/skills/address-sanitizer/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill address-sanitizer -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/address-sanitizerManually: put the files in place
.devin/skills/address-sanitizer/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill address-sanitizer -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about address-sanitizer
How do I install address-sanitizer in Claude Code?
Run npx skills add trailofbits/skills --skill address-sanitizer -a claude-code. The skill lands at ~/.claude/skills/address-sanitizer/SKILL.md.
What does address-sanitizer do?
It hands the agent a working routine for ASan builds: compiler flags, ASAN_OPTIONS, report reading, and the fuzzer settings that keep the process alive long enough to find something.
Does it work on Windows and macOS?
Windows support is experimental and macOS is partial, with some features not working. Linux is where ASan is fully supported.
