Skip to main content
affpapa.org
RU EN
skill CX Codex

harness-writing — Claude Code skill for C/C++ and Rust fuzzing

Helps you write and fix a fuzzing harness: map raw bytes onto API arguments, kill non-determinism, stop chasing crashes that never reproduce.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill harness-writing -a claude-code
Open on GitHub

What harness-writing does

A harness is the entrypoint that takes random bytes from the fuzzer and routes them into the code under test. What it covers decides which paths get exercised and whether real bugs surface. The skill walks through picking targets, writing a minimal LLVMFuzzerTestOneInput or fuzz_target!, adding size checks, and turning bytes into typed values.

Two ways to handle structured input: plain casts like *(uint32_t*)(data), or FuzzedDataProvider with ConsumeIntegral<uint32_t>() and ConsumeBytesWithTerminator<char>(32, 0xFF). In Rust there is i32::from_ne_bytes. Non-determinism gets its own treatment: when the same input produces different behaviour, crashes stop reproducing, and that is the first thing to check when a campaign reports failures you cannot replay.

Reach for it when a campaign finds nothing or coverage stays flat, when the target API wants structured data instead of raw bytes, or when several related functions should be fuzzed together. If the project already ships well-tested harnesses, or the tool generates them for you, there is little to gain.

What it helps with

  • write a first fuzzing harness for C/C++ or Rust
  • map raw bytes onto the target API's arguments
  • make fuzzer crashes reproducible again
  • raise coverage in a campaign that finds nothing
  • decide which functions to fuzz in one harness

Example prompts for the agent

  • Write a minimal LLVMFuzzerTestOneInput harness for the header parser
  • Rewrite the harness with FuzzedDataProvider so it pulls strings and integers
  • The campaign reports crashes that will not reproduce — check the harness for non-determinism

How to install harness-writing

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill harness-writing -a claude-code

2Manually: put the files in place

~/.claude/skills/harness-writing/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/harness-writing/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about harness-writing

How do I install harness-writing in Claude Code?

Run npx skills add trailofbits/skills --skill harness-writing -a claude-code. The skill lands at ~/.claude/skills/harness-writing/SKILL.md.

What does harness-writing do?

It helps design and improve fuzzing harnesses for C/C++ and Rust: choosing targets, parsing input, handling typed arguments and non-determinism.

When should I skip this skill?

When the project already has well-tested harnesses, or the tool generates them automatically and the results are good enough.

Similar skills

All skills for Testing and QA →
improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. 1,163,035installs design-taste-frontend Leonxlnx This skill directs the design of public pages and work screens, then checks the result in a browser through screenshots. Use it when an interface feels generic or unfinished. CX Codex +1 678,700installs tdd Matt Pocock Guides the red-green TDD loop: ensures tests are written first, keep them at public interfaces, and avoid coupling to implementation details. 1,141,062installs skill-creator official anthropics Creates and refines skills, then tests them with prompts, evaluations, and performance checks. 414,180installs agent-browser vercel-labs A CLI skill for browser control: it opens pages, fills forms, clicks buttons, and tests web apps. Use it when an agent needs to act inside a website. CX Codex +1 1,200,000installs prototype Matt Pocock Creates throwaway prototypes for checking state logic or exploring UI before committing the decision to the main codebase. 986,201installs

From the same set77

solana-vulnerability-scanner Detects 6 critical vulnerabilities across native Rust and Anchor programs on Solana. Helps identify flaws in account validation, PDA derivation, and CPI logic. CX Codex +1 5,600installs token-integration-analyzer Checks ERC20 and ERC721 implementations plus code that integrates external tokens. Use it before accepting tokens with non-standard transfer or approval behaviour. CX Codex +1 5,500installs cargo-fuzz Sets up cargo-fuzz inside a Cargo-based Rust crate and walks through the harness, sanitizers and crash triage. CX Codex +1 5,400installs constant-time-analysis Inspects compiled assembly and bytecode for timing side-channels. It flags secret-dependent branches and variable-time operations in crypto routines. CX Codex +1 5,400installs firebase-apk-scanner Unpacks an Android APK, pulls out its Firebase config and probes databases, buckets and functions for open access. Built for mobile app security audits. CX Codex +1 5,400installs guidelines-advisor Audits smart contract codebases against Trail of Bits guidelines. It spots upgradeability pitfalls, flawed inheritance, and testing gaps. CX Codex +1 5,500installs coverage-analysis Measures code reached by a fuzzing campaign and helps explain stalled path discovery. Use it to inspect harness changes, corpus results, and unreachable branches. CX Codex +1 5,500installs fuzzing-dictionary Generates and connects token dictionaries for parsers and protocols in libFuzzer or AFL++ when coverage stalls on initial checks. CX Codex +1 5,300installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor