Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

coverage-analysis — Claude Code skill for fuzzing coverage

Measures code reached by a fuzzing campaign and helps explain stalled path discovery. Use it to inspect harness changes, corpus results, and unreachable branches.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill coverage-analysis -a claude-code
Open on GitHub

What coverage-analysis does

This skill examines coverage reached during fuzzing through llvm-cov, lcov, or a fuzzer's own output. It covers setting a campaign baseline, reading reports, and turning uncovered code into harness, seed, or dictionary work.

For C and C++, it describes LLVM and GCC instrumentation flags, running a corpus with a separate executable, processing profiles with llvm-profdata, and producing llvm-cov reports. It also includes commands for cargo-fuzz and gcovr. Measure the corpus after each campaign because that result can be compared across fuzzing tools.

Coverage is not an absolute measure of fuzzer performance. Treat a drop or plateau as a reason to inspect the harness or changes in the system under test.

What it helps with

  • establish a coverage baseline for a new campaign
  • locate uncovered branches in a report
  • verify coverage after a harness change
  • choose seeds or dictionary entries for blocked checks

Example prompts for the agent

  • Analyze this fuzzing corpus with `llvm-cov` and identify uncovered files.
  • Compare coverage before and after my harness change.
  • Show how to generate a `gcovr` report for this corpus.

How to install coverage-analysis

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill coverage-analysis -a claude-code

2Manually: put the files in place

~/.claude/skills/coverage-analysis/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/coverage-analysis/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

fix-merge-conflicts cursor Resolves merge conflicts in a branch, then checks the build and tests before wrapping up. Use it when several conflicted files need focused fixes without a refactor. Claude Code CX Codex Cursor +1 2,700installs visual-verdict Yeachan-Heo A visual QA skill that compares generated UI screenshots against reference images and returns a structured JSON verdict for layout iterations. Claude Code CX Codex Cursor +1 890installs ai-debt-detector Adit Jain This skill audits AI-generated code for missed failure paths, orphaned resources, fake dependencies, and architecture drift before a merge. Claude Code CX Codex Cursor 2,900installs arize-experiment official arize Runs Arize experiments with the ax CLI to benchmark models and export evaluation scores across dataset versions. GitHub Copilot 1,100installs arize-evaluator official arize Runs LLM-as-judge workflows in Arize for spans and experiments, with evaluator management, task control, column mapping, and continuous monitoring. GitHub Copilot 1,100installs arize-dataset official arize This skill manages Arize datasets and examples through ax. Use it for test sets, evaluation examples, and dataset exports. GitHub Copilot 1,100installs improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. Claude Code 1,163,035installs design-taste-frontend Leonxlnx This skill directs the design of public pages and work screens, then checks the result in a browser through screenshots. Use it when an interface feels generic or unfinished. Claude Code CX Codex Cursor +1 673,100installs

Questions about coverage-analysis

How do I install coverage-analysis in Claude Code?

Run npx skills add trailofbits/skills --skill coverage-analysis -a claude-code, then run npx skills add trailofbits/skills --skill coverage-analysis -a claude-code again. The skill is located at ~/.claude/skills/coverage-analysis/SKILL.md.

What does coverage-analysis do?

It measures and interprets code coverage from a fuzzing campaign. Its guidance connects uncovered regions to harness, seed, and dictionary changes.

Why does coverage-analysis use the corpus after a campaign?

A corpus-based measurement is reproducible and comparable across fuzzing tools. Internal fuzzer metrics are less suitable for that comparison.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor