coverage-analysis
Coverage analysis measures code exercised during fuzzing. Use when assessing harness effectiveness or identifying fuzzing blockers.
npx skills add trailofbits/skills --skill coverage-analysis --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Coverage Analysis Coverage analysis is essential for understanding which parts of your code are exercised during fuzzing. It helps identify fuzzing blockers like magic value checks and tracks the effectiveness of harness improvements over time. ## Overview Code coverage during fuzzing serves two critical purposes: 1. **Assessing harness effectiveness**: Understand which parts of your application are actually executed by your fuzzing harnesses 2. **Tracking fuzzing progress**: Monitor how coverage changes when updating harnesses, fuzzers, or the system under test (SUT) Coverage is a proxy for fuzzer capability and performance. While coverage [is not ideal for measuring fuzzer performance](https://arxiv.org/abs/1808.09700) in absolute terms, it reliably indicates whether your harness works effectively in a given setup. ### Key Concepts | Concept | Description | |---------|-------------| | **Coverage instrumentation** | Compiler flags that track which code paths are executed | | **Corpus coverage** | Coverage achieved by running all test cases in a fuzzing corpus | | **Magic value checks** | Hard-to-discover conditional checks that block fuzzer progress | | **Coverage-guided fuzzing
- Overview
- Key Concepts
- When to Apply
- Quick Reference
- Ideal Coverage Workflow
- Step-by-Step
- Step 1: Build with Coverage Instrumentation
- Step 2: Create Execution Runtime (C/C++ only)
- Step 3: Execute on Corpus
- Step 4: Process Coverage Data
- Step 5: Analyze Results
- Common Patterns
- Pattern: Identifying Magic Values
- Pattern: Handling Crashing Inputs
main.cc harness.cc execute-rt.cc -o fuzz_exec main.cc harness.cc execute-rt.cc -o fuzz_exec_gcov rustup toolchain install nightly --component llvm-tools-preview cargo +nightly fuzz coverage fuzz_target_1 Merge raw profile data llvm-profdata merge -sparse fuzz.profraw -o fuzz.profdata Generate text report llvm-cov report ./fuzz_exec \ Generate HTML report llvm-cov show ./fuzz_exec \
What does the coverage-analysis skill do?
Coverage analysis measures code exercised during fuzzing. Use when assessing harness effectiveness or identifying fuzzing blockers.
How do I install it?
Run `npx skills add trailofbits/skills --skill coverage-analysis --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.