Skip to main content
skill Claude Code CX Codex Cursor GitHub Copilot

atheris — Claude Code skill: what it does, how to install

Guides setup of coverage-guided fuzzing for Python code and C extensions with Atheris. Use it to investigate crashes and memory corruption.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓
npx skills add trailofbits/skills --skill atheris -a claude-code
Open on GitHub

What atheris does

This skill guides an agent through creating and running an Atheris harness, a Python fuzzer based on libFuzzer. It covers the TestOneInput entry point, the @atheris.instrument_func decorator, and launching with atheris.Setup() plus atheris.Fuzz().

For targets with several argument types, it uses atheris.FuzzedDataProvider to draw typed values from a byte sequence. The skill also covers atheris.instrument_imports() for imported modules and harness rules: handle expected exceptions, while letting unexpected failures reach the fuzzer.

Atheris runs on Linux and macOS and needs Python 3.7 or later with a recent clang. Its Docker setup compiles C extensions with AddressSanitizer, so check compiler settings before fuzzing native code.

What it helps with

  • build a TestOneInput harness
  • instrument a Python function for coverage
  • supply typed arguments with FuzzedDataProvider
  • check a C extension for memory corruption
  • run fuzzing with AddressSanitizer

Example prompts for the agent

  • “Create an Atheris harness for the byte parser in `fuzz.py`.”
  • “Use `FuzzedDataProvider` in `TestOneInput` for a string name and a boolean flag.”
  • “Prepare a Docker build for fuzzing this C extension with Atheris and AddressSanitizer.”

How to install atheris

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill atheris -a claude-code

2Manually: put the files in place

~/.claude/skills/atheris/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/atheris/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

lint-and-validate sickn33 Runs configured linters and type checkers after code changes, telling actual failures apart from tools that never ran. Claude Code CX Codex Cursor +1 1,300installs dart-add-unit-test dart-lang Writes Dart and Flutter unit tests with package:test: files under test/, mockito mocks when dependencies get in the way, and a rerun loop until the suite is green. Claude Code CX Codex Cursor +1 19,100installs improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. Claude Code 1,163,035installs design-taste-frontend Leonxlnx This skill directs the design of public pages and work screens, then checks the result in a browser through screenshots. Use it when an interface feels generic or unfinished. Claude Code CX Codex Cursor +1 673,100installs tdd Matt Pocock Guides the red-green TDD loop: ensures tests are written first, keep them at public interfaces, and avoid coupling to implementation details. Claude Code 1,141,062installs skill-creator official anthropics Creates and refines skills, then tests them with prompts, evaluations, and performance checks. Claude Code Claude.ai 414,180installs agent-browser vercel-labs A CLI skill for browser control: it opens pages, fills forms, clicks buttons, and tests web apps. Use it when an agent needs to act inside a website. Claude Code CX Codex Cursor +1 1,200,000installs prototype Matt Pocock Creates throwaway prototypes for checking state logic or exploring UI before committing the decision to the main codebase. Claude Code 986,201installs

Questions about atheris

How do I install atheris in Codex?

Run npx skills add trailofbits/skills --skill atheris -a codex in the project directory. The skill is installed at .agents/skills/atheris/SKILL.md.

What does atheris do?

The skill helps an agent set up coverage-guided fuzzing for Python code and Python C extensions using Atheris. It covers harnesses, import instrumentation, and AddressSanitizer.

What does Atheris require?

Linux and macOS use Python 3.7 or later and a recent clang. The Docker environment uses Docker Desktop.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor