libfuzzer — Claude Code skill: what it does, how to install
A skill that walks the agent through libFuzzer: the harness, the -fsanitize=fuzzer build, corpus handling, campaign triage. For C/C++ built with Clang.
npx skills add trailofbits/skills --skill libfuzzer -a claude-codeWhat libfuzzer does
Fuzzing a C/C++ library usually stalls at the same place: nobody writes the harness. This skill covers LLVMFuzzerTestOneInput structure, the -fsanitize=fuzzer build, corpus and dictionary handling, sanitizer wiring, and how to read a finished run.
The harness rules are spelled out: never call exit(), join threads before returning, stay away from randomness, reset global state between inputs. Structured input goes through FuzzedDataProvider from LLVM. You build with clang++ and the fuzzer flag next to AddressSanitizer, since a plain build hides memory errors the fuzzer would otherwise catch.
Clang is not optional here. GCC will not link this, because -fsanitize=fuzzer ships with LLVM. libFuzzer has been maintenance-only since late 2022, and the author still calls it the starting point: setup is short. Harnesses carry over to AFL++ later when one core stops being enough.
What it helps with
- write a first
LLVMFuzzerTestOneInputharness for a C library - compile a target with
-fsanitize=fuzzerand AddressSanitizer - seed a corpus and a dictionary for a binary format
- figure out why a run returns no crashes
- port an existing harness to AFL++ for multi-core fuzzing
Example prompts for the agent
- Write an `LLVMFuzzerTestOneInput` harness for the parser in `parser.c` and build it with `-fsanitize=fuzzer,address`
- The fuzzer keeps running and finds nothing — check the harness for state leaking between inputs
- How do I feed a dictionary into a libFuzzer run on a binary format?
How to install libfuzzer
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill libfuzzer -a claude-code2Manually: put the files in place
~/.claude/skills/libfuzzer/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/libfuzzer/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill libfuzzer -a codex2Manually: put the files in place
.agents/skills/libfuzzer/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill libfuzzer -a cursor2Manually: put the files in place
.cursor/skills/libfuzzer/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills libfuzzer2Manually: put the files in place
.github/skills/libfuzzer/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill libfuzzer -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/libfuzzerManually: put the files in place
.devin/skills/libfuzzer/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill libfuzzer -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set35
The whole set →Similar
Questions about libfuzzer
How do I install libfuzzer in Claude Code?
Run npx skills add trailofbits/skills --skill libfuzzer -a claude-code. The skill lands at ~/.claude/skills/libfuzzer/SKILL.md.
What does libfuzzer do?
It guides the agent through libFuzzer setup: writing the harness, compiling with -fsanitize=fuzzer, adding a corpus, dictionary and sanitizers, then triaging what the campaign returns.
Should I use libFuzzer or AFL++?
libFuzzer is the quicker install and runs single-core, while AFL++ is built for multi-core campaigns with more varied mutations. The harnesses are compatible, so switching later costs little.
