# address-sanitizer

This skill gives an agent a routine for building code with -fsanitize=address, reading ASan reports and freeing the fuzzer from memory caps. Aimed at C/C++ and Rust with unsafe blocks.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5400 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/address-sanitizer/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/address-sanitizer

## What it does

The skill walks an agent through an AddressSanitizer build: compile with `-fsanitize=address` plus `-g`, set `ASAN_OPTIONS`, then read the report to find the overflow or the read after free. It ships a step-by-step procedure, a short table of options (`verbosity`, `abort_on_error`, `detect_leaks`) and separate notes for libFuzzer, AFL++ and cargo-fuzz.

ASan reserves around 20TB of virtual address space, so the fuzzer's memory cap has to go: `-rss_limit_mb=0` under libFuzzer, `-m none` under AFL++. Leave the cap in place and the runner kills the process at startup, which reads like a crash in your own code. Rust goes through `--sanitizer=address` in `cargo fuzz`.

Expect the build to run about 2-4 times slower. Windows support is experimental, macOS partial. Production is the wrong place for such a binary: it is slower and not safer, so keep it for tests and fuzzing runs. Pure Go or Java gains little here.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill address-sanitizer -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/address-sanitizer/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/address-sanitizer/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill address-sanitizer -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/address-sanitizer/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill address-sanitizer -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/address-sanitizer/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills address-sanitizer
```

2. **Manually: put the files in place**
- File: `.github/skills/address-sanitizer/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill address-sanitizer -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/address-sanitizer
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/address-sanitizer/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill address-sanitizer -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/address-sanitizer/SKILL.md

## When to use it
- build a C or C++ target under `-fsanitize=address`
- read an ASan stack trace down to the offending line
- stop a fuzzer from dying on ASan's virtual memory demand
- turn on leak detection for a unit test suite
- add ASan to a Rust crate that leans on unsafe blocks

## Example prompts
- Build `harness.cc` with `-fsanitize=fuzzer,address -g` and run it with `-rss_limit_mb=0`
- Here is the ASan report — which line is the use-after-free on?
- Add `--sanitizer=address` to our cargo-fuzz target and check what the leak report says

## Similar
- [rust-security](https://affpapa.org/en/nevibecode/skills/rust-security.md) — skill · 544 installs
- [memory-safety-patterns](https://affpapa.org/en/nevibecode/skills/memory-safety-patterns.md) — skill · 11746 installs
- [differential-fuzzer](https://affpapa.org/en/nevibecode/skills/differential-fuzzer.md) — skill · 1200 installs
- [rust-systems-programming](https://affpapa.org/en/nevibecode/skills/rust-systems-programming.md) — skill · 485 installs
- [output-sanitizer](https://affpapa.org/en/nevibecode/skills/output-sanitizer.md) — skill · 475 installs
- [security-fuzzing](https://affpapa.org/en/nevibecode/skills/security-fuzzing.md) — skill · 583 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md