Agent Skill
Fuzzing Obstacles skill
fuzzing-obstaclestrailofbits/skillsplugins/testing-handbook-skills/skills/fuzzing-obstacles/SKILL.md
Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and avoiding the false positives a patch can introduce. Use when a fuzzer is stuck at validation, when coverage shows large regions behind a checksum, or when valid inputs are impractical to generate.
always on
96 tokname + description
once used
3,427 tokSKILL.md body
bundled files
23 KB
repo stars
7.7kGitHub
Install the Fuzzing Obstacles skill
Skills CLI (Claude Code, Codex, Cursor and others)
npx skills add https://github.com/trailofbits/skills --skill fuzzing-obstacles
Claude Code, by hand (all projects)
git clone --depth 1 https://github.com/trailofbits/skills.git /tmp/skills mkdir -p ~/.claude/skills cp -R /tmp/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.claude/skills/fuzzing-obstacles
For one project only, copy the folder into .claude/skills/ in that project instead. The agent picks it up when a task matches its description.
What it costs your context
Agent Skills load in three steps. Tokens counted with the o200k tokenizer; your model's count will differ a little.
| When | What loads | Cost |
|---|---|---|
| Every session | Name and description | 96 tok |
| When the agent uses it | The SKILL.md instructions | 3,427 tok |
| Only if opened | 2 bundled files (3 KB) | varies |
Until it is used, fuzzing-obstacles costs about 14× less than the median MCP server we measured (1,362 tokens on every turn). Installing all 97 skills from trailofbits/skills would load 7,555 tokens of descriptions. Skills vs MCP study
Checks
Our checks found nothing to flag: it follows the Agent Skills specification's naming and size guidelines and doesn't pipe downloads into a shell.
Checked 2026-10-22 · method
What's inside
The headings of its SKILL.md. Read the full file on GitHub.
- Overcoming Fuzzing Obstacles
- Overview
- Key Concepts
- When to Apply
- Quick Reference
- Step-by-Step
- Step 1: Identify the Obstacle
- Step 2: Add Conditional Compilation
- Step 3: Verify Coverage Improvement
- Step 4: Assess False Positive Risk
- Common Patterns
- Pattern: Bypass Checksum Validation
- Pattern: Deterministic PRNG Seeding
- Pattern: Careful Validation Skip
- Pattern: Bypass Complex Format Validation
- Advanced Usage
- Tips and Tricks
- Real-World Examples
- Measuring Patch Effectiveness
- Combining with Other Techniques
- Anti-Patterns
- Tool-Specific Guidance
- libFuzzer
- AFL++
More skills from trailofbits/skills
- address-sanitizertrailofbits/skills
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.
7.7k97 tok idle · 2,723 in use - adjudicate-regressiontrailofbits/skills
Use when deciding whether source and live reproduction evidence establish a new regression or an exclusion.
7.7k23 tok idle · 505 in use - aflpptrailofbits/skills
Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.
7.7k91 tok idle · 5,638 in use - agentic-actions-auditortrailofbits/skills
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
7.7k105 tok idle · 4,775 in use - algorand-vulnerability-scannertrailofbits/skills
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
7.7k54 tok idle · 2,979 in use - atheristrailofbits/skills
Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.
7.7k86 tok idle · 3,559 in use - audit-augmentationtrailofbits/skills
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.
7.7k130 tok idle · 2,108 in use - audit-context-buildingtrailofbits/skills
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.
7.7k55 tok idle · 797 in use