libfuzzer
Coverage-guided fuzzer built into LLVM for C/C++ projects. Use for fuzzing C/C++ code that can be compiled with Clang.
npx skills add trailofbits/skills --skill libfuzzer --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
The skill describes a coverage-guided fuzzer that is built into LLVM (libFuzzer) and is intended for fuzzing C/C++ code compiled with Clang. It presents libFuzzer as an in-process fuzzer and the recommended starting point for fuzzing C/C++ projects due to its simplicity and LLVM integration. It includes guidance on when to use it, a quick-start harness example, and instructions for compilation, corpus management, and running campaigns. It also covers installation prerequisites, platform notes, verification steps, and common options for running and debugging fuzzing campaigns, as well as details on harness structure, interleaved fuzzing, and dictionary usage.
How it works
It instructs the agent to:
- Prefer libFuzzer for quick setup and single-project fuzzing when the project uses Clang. It contrasts libFuzzer with AFL++, LibAFL, and Honggfuzz and notes compatibility to ease transitions.
- Provide a harness that defines LLVMFuzzerTestOneInput and calls the target function with fuzzed data.
- Compile with fuzzing instrumentation using flags such as -fsanitize=fuzzer and optional sanitizers, and link the libFuzzer runtime.
- Manage and seed a corpus in a corpus/ directory, with optional minimized corpus via -merge.
- Run fuzzing campaigns with options like -jobs, -fork, -ignore_crashes, -max_len, -timeout, and -dict, and interpret output statistics.
- Use a dictionary file and, for complex inputs, the FuzzedDataProvider.h helper to generate structured inputs.
- Follow harness rules to ensure fast, deterministic, and isolated executions, and keep harness code straightforward.
- Optionally enable coverage analysis using instrumentation and llvm-profdata/llvm-cov tools to produce coverage reports.
- Integrate ASan/UBSan/MSan sanitizers in various combinations for memory and UB detection, including specific command lines and caveats about performance and memory.
When to use it
The skill indicates choosing libFuzzer for:
- Quick setup for C/C++ code
- Projects compiled with Clang
- Initial single-core fuzzing suffices, with potential later transition to multi-core or more advanced fuzzers
- Harnesses are compatible with AFL++ for transitions
What it can touch
- Prerequisites: LLVM/Clang compiler, LLVM tools for coverage (optional)
- Build and execution: harness.cc, target.cc, and fuzz binary produced by clang++ with fuzzing instrumentation
- Corpus directory: corpus/ and minimized_corpus/
- Dictionary: format.dict or similar dictionaries via -dict
- Environment: environment variable LLVM_PROFILE_FILE for coverage collection
- Sanitizers: flags for ASan, UBSan, MSan as described in the instructions
Caveats
- libFuzzer is in maintenance-only mode since late 2022 while described as easy to install and maintain for the foreseeable future
- Running with sanitizers introduces significant slowdown and memory demands, with notes on memory limits and virtualization requirements
- Coverage analysis requires additional tools and steps (llvm-profdata, llvm-cov) beyond basic fuzzing
- Harness testing and multi-core fuzzing may require transitioning to alternative fuzzers for advanced features
# libFuzzer libFuzzer is an in-process, coverage-guided fuzzer that is part of the LLVM project. It's the recommended starting point for fuzzing C/C++ projects due to its simplicity and integration with the LLVM toolchain. While libFuzzer has been in maintenance-only mode since late 2022, it is easier to install and use than its alternatives, has wide support, and will be maintained for the foreseeable future. ## When to Use | Fuzzer | Best For | Complexity | |--------|----------|------------| | libFuzzer | Quick setup, single-project fuzzing | Low | | AFL++ | Multi-core fuzzing, diverse mutations | Medium | | LibAFL | Custom fuzzers, research projects | High | | Honggfuzz | Hardware-based coverage | Medium | **Choose libFuzzer when:** - You need a simple, quick setup for C/C++ code - Project uses Clang for compilation - Single-core fuzzing is sufficient initially - Transitioning to AFL++ later is an option (harnesses are compatible) **Note:** Fuzzing harnesses written for libFuzzer are compatible with AFL++, making it easy to transition if you need more advanced features like better multi-core support. ## Quick Start ```c++ #include <stdint.h> #include <stddef.h> extern "C" int LL
- When to Use
- Quick Start
- Installation
- Prerequisites
- Linux (Ubuntu/Debian)
- macOS
- Windows
- Verification
- Writing a Harness
- Harness Structure
- Harness Rules
- Using FuzzedDataProvider for Complex Inputs
- Interleaved Fuzzing
- Compilation
What does the libfuzzer skill do?
Coverage-guided fuzzer built into LLVM for C/C++ projects. Use for fuzzing C/C++ code that can be compiled with Clang.
How do I install it?
Run `npx skills add trailofbits/skills --skill libfuzzer --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.