# harness-writing

Helps you write and fix a fuzzing harness: map raw bytes onto API arguments, kill non-determinism, stop chasing crashes that never reproduce.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5400 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/harness-writing/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/harness-writing

## What it does

A harness is the entrypoint that takes random bytes from the fuzzer and routes them into the code under test. What it covers decides which paths get exercised and whether real bugs surface. The skill walks through picking targets, writing a minimal `LLVMFuzzerTestOneInput` or `fuzz_target!`, adding size checks, and turning bytes into typed values.

Two ways to handle structured input: plain casts like `*(uint32_t*)(data)`, or `FuzzedDataProvider` with `ConsumeIntegral<uint32_t>()` and `ConsumeBytesWithTerminator<char>(32, 0xFF)`. In Rust there is `i32::from_ne_bytes`. Non-determinism gets its own treatment: when the same input produces different behaviour, crashes stop reproducing, and that is the first thing to check when a campaign reports failures you cannot replay.

Reach for it when a campaign finds nothing or coverage stays flat, when the target API wants structured data instead of raw bytes, or when several related functions should be fuzzed together. If the project already ships well-tested harnesses, or the tool generates them for you, there is little to gain.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill harness-writing -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/harness-writing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/harness-writing/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill harness-writing -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/harness-writing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill harness-writing -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/harness-writing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills harness-writing
```

2. **Manually: put the files in place**
- File: `.github/skills/harness-writing/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill harness-writing -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/harness-writing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/harness-writing/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill harness-writing -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/harness-writing/SKILL.md

## When to use it
- write a first fuzzing harness for C/C++ or Rust
- map raw bytes onto the target API's arguments
- make fuzzer crashes reproducible again
- raise coverage in a campaign that finds nothing
- decide which functions to fuzz in one harness

## Example prompts
- Write a minimal `LLVMFuzzerTestOneInput` harness for the header parser
- Rewrite the harness with `FuzzedDataProvider` so it pulls strings and integers
- The campaign reports crashes that will not reproduce — check the harness for non-determinism

## Similar
- [improve-codebase-architecture](https://affpapa.org/en/nevibecode/skills/improve-codebase-architecture.md) — skill · 1163035 installs
- [design-taste-frontend](https://affpapa.org/en/nevibecode/skills/design-taste-frontend.md) — skill · 678700 installs
- [tdd](https://affpapa.org/en/nevibecode/skills/tdd.md) — skill · 1141062 installs
- [skill-creator](https://affpapa.org/en/nevibecode/skills/skill-creator.md) — skill · 414180 installs
- [agent-browser](https://affpapa.org/en/nevibecode/skills/vercel-labs-agent-browser.md) — skill · 1200000 installs
- [prototype](https://affpapa.org/en/nevibecode/skills/prototype.md) — skill · 986201 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md