Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

ossfuzz — Claude Code skill: what it does, how to install

Guides your AI agent through enrolling projects in Google OSS-Fuzz and running fuzzer targets locally with helper scripts.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill ossfuzz -a claude-code
Open on GitHub

What ossfuzz does

This skill guides the agent in connecting open-source projects to Google's continuous fuzzing service. It provides instructions to create the necessary setup files: project.yaml, a custom Dockerfile with build dependencies, and build.sh to compile harnesses.

The workflow uses the infra/helper.py script via uv to manage Docker containers, build fuzzers with sanitizers such as AddressSanitizer, and run individual test targets. It also explains how to inspect build status logs and reproduce crashes from bug reports locally.

Generating local coverage reports requires installing gsutil on your system beforehand. This workflow does not fit closed-source repositories unless you plan to host your own instance of the fuzzing infrastructure.

What it helps with

  • prepare project.yaml, Dockerfile, and build.sh for OSS-Fuzz enrollment
  • build fuzzing harnesses locally with AddressSanitizer
  • reproduce crash reports locally from bug findings
  • generate local code coverage reports using helper scripts

Example prompts for the agent

  • Help me write the Dockerfile and build.sh to enroll this project into OSS-Fuzz
  • Build and run our fuzzer harnesses locally with AddressSanitizer using helper.py
  • How do I reproduce this OSS-Fuzz crash report locally?

How to install ossfuzz

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill ossfuzz -a claude-code

2Manually: put the files in place

~/.claude/skills/ossfuzz/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/ossfuzz/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

lint-and-validate sickn33 Runs configured linters and type checkers after code changes, telling actual failures apart from tools that never ran. Claude Code CX Codex Cursor +1 1,300installs dart-add-unit-test dart-lang Writes Dart and Flutter unit tests with package:test: files under test/, mockito mocks when dependencies get in the way, and a rerun loop until the suite is green. Claude Code CX Codex Cursor +1 19,100installs improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. Claude Code 1,163,035installs design-taste-frontend Leonxlnx This skill directs the design of public pages and work screens, then checks the result in a browser through screenshots. Use it when an interface feels generic or unfinished. Claude Code CX Codex Cursor +1 673,100installs tdd Matt Pocock Guides the red-green TDD loop: ensures tests are written first, keep them at public interfaces, and avoid coupling to implementation details. Claude Code 1,141,062installs skill-creator official anthropics Creates and refines skills, then tests them with prompts, evaluations, and performance checks. Claude Code Claude.ai 414,180installs agent-browser vercel-labs A CLI skill for browser control: it opens pages, fills forms, clicks buttons, and tests web apps. Use it when an agent needs to act inside a website. Claude Code CX Codex Cursor +1 1,200,000installs prototype Matt Pocock Creates throwaway prototypes for checking state logic or exploring UI before committing the decision to the main codebase. Claude Code 986,201installs

Questions about ossfuzz

How do I install ossfuzz in Claude Code?

Run npx skills add trailofbits/skills --skill ossfuzz -a claude-code in your terminal.

What does the ossfuzz skill do?

It teaches the agent how to configure continuous fuzzing via Google's OSS-Fuzz, run harnesses inside Docker containers locally, and evaluate test coverage.

What dependencies are required for coverage analysis?

You need gsutil installed on your machine to pull coverage data before running infra/helper.py with --sanitizer=coverage.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor