Trail of Bits' skills for fuzzing and crypto testing, from its Testing Handbook: libFuzzer, AFL++, cargo-fuzz, Atheris, OSS-Fuzz and more.
Pack · 15 skillsby trailofbits
4 images
About
Testing Handbook Skills is Trail of Bits' set of Agent Skills built from its Application Security Testing Handbook (appsec.guide). They teach your agent how to set up and run fuzzers, write harnesses that find real bugs, read sanitizer and coverage output, and test cryptographic code against known attacks and timing leaks. What its skills teach your agent - Fuzzers: libFuzzer and AFL++ for C and C++, cargo-fuzz for Rust, LibAFL for building custom fuzzers, Atheris for Python and its C extensions, and Ruzzy, Trail of Bits' fuzzer for Ruby and native gems - Harness writing: map raw bytes onto the API you're testing, generate structured inputs, and avoid non-determinism and crashes that won't reproduce - Getting a campaign to work: AddressSanitizer builds and crash reports, coverage analysis, fuzzing dictionaries, and patching past checksums, magic values and other checks that stall a fuzzer - Continuous fuzzing: enroll an open-source project in OSS-Fuzz, test its build locally and reproduce its crash reports - Crypto testing: check an implementation against Project Wycheproof's test vectors, and measure timing side channels with dudect and Timecop - A generator skill that writes new skills from the handbook's sections and checks them with its validator How it connects - In Claude Code, run /plugin marketplace add trailofbits/skills, then install testing-handbook-skills from /plugin menu. In Codex, run codex plugin marketplace add trailofbits/skills, then codex plugin add testing-handbook-skills@trailofbits. - The skills are plain Agent Skills, so other agents that read skills can use them too. - There's no account or sign-in. The fuzzers and compilers run on your machine, and the skills tell your agent how to install and drive them. Good to know - These skills are guidance for your agent, not a scanner: your agent writes the harnesses and runs the tools in your project. - Trail of Bits' marketplace has many other security plugins, from static analysis to supply-chain audits, each installed on its own.
Once it’s added
“Set up libFuzzer for this C library and write a first harness.”
“Our AFL++ campaign has plateaued. What should we try next?”
“Fuzz this Rust crate with cargo-fuzz.”
“Fuzz this Python package and its C extension with Atheris.”
“Test our crypto library against the Wycheproof test vectors.”
“Is this comparison function constant-time? Measure it.”
Before you add it
Reads only
Your source code, build files and existing tests · Fuzzer output, sanitizer crash reports and coverage data · OSS-Fuzz crash reports you want reproduced
Makes changes · your agent can ask first
Fuzzing harnesses, dictionaries and build scripts in your project · OSS-Fuzz project files (project.yaml, Dockerfile, build.sh) · Test code that runs Wycheproof vectors or timing checks
Pack · 15 skills, each with its own page
From people who use it
Step by step
No reviews yet. Used Testing Handbook Skills? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
Runs on your machine.
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.copilot/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.copilot/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.copilot/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.copilot/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.copilot/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.copilot/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.copilot/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.copilot/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.copilot/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.copilot/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.copilot/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.copilot/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.copilot/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.copilot/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.copilot/skills/wycheproof
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.cursor/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.cursor/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.cursor/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.cursor/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.cursor/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.cursor/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.cursor/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.cursor/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.cursor/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.cursor/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.cursor/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.cursor/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.cursor/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.cursor/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.cursor/skills/wycheproof
Runs on your machine.
/plugin marketplace add trailofbits/skills /plugin install testing-handbook-skills@trailofbits
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.claude/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.claude/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.claude/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.claude/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.claude/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.claude/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.claude/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.claude/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.claude/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.claude/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.claude/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.claude/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.claude/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.claude/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.claude/skills/wycheproof
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.agents/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.agents/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.agents/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.agents/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.agents/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.agents/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.agents/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.agents/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.agents/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.agents/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.agents/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.agents/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.agents/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.agents/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.agents/skills/wycheproof
Runs on your machine.
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.gemini/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.gemini/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.gemini/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.gemini/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.gemini/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.gemini/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.gemini/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.gemini/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.gemini/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.gemini/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.gemini/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.gemini/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.gemini/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.gemini/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.gemini/skills/wycheproof
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer .agents/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp .agents/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris .agents/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz .agents/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing .agents/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis .agents/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary .agents/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles .agents/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing .agents/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl .agents/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer .agents/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz .agents/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy .agents/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator .agents/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof .agents/skills/wycheproof
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.openclaw/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.openclaw/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.openclaw/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.openclaw/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.openclaw/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.openclaw/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.openclaw/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.openclaw/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.openclaw/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.openclaw/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.openclaw/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.openclaw/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.openclaw/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.openclaw/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.openclaw/skills/wycheproof
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.config/opencode/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.config/opencode/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.config/opencode/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.config/opencode/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.config/opencode/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.config/opencode/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.config/opencode/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.config/opencode/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.config/opencode/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.config/opencode/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.config/opencode/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.config/opencode/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.config/opencode/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.config/opencode/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.config/opencode/skills/wycheproof
Runs on your machine.
npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/address-sanitizer ~/.hermes/skills/address-sanitizer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/aflpp ~/.hermes/skills/aflpp npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/atheris ~/.hermes/skills/atheris npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.hermes/skills/cargo-fuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.hermes/skills/constant-time-testing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.hermes/skills/coverage-analysis npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-dictionary ~/.hermes/skills/fuzzing-dictionary npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/fuzzing-obstacles ~/.hermes/skills/fuzzing-obstacles npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/harness-writing ~/.hermes/skills/harness-writing npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libafl ~/.hermes/skills/libafl npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/libfuzzer ~/.hermes/skills/libfuzzer npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ossfuzz ~/.hermes/skills/ossfuzz npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/ruzzy ~/.hermes/skills/ruzzy npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/testing-handbook-generator ~/.hermes/skills/testing-handbook-generator npx -y degit trailofbits/skills/plugins/testing-handbook-skills/skills/wycheproof ~/.hermes/skills/wycheproof
Scanned and passed · checked 11 h ago
Skills people install alongside Testing Handbook Skills.
Nothing new reaches your agent until a person has looked at it.
Scanned on every change, and again when our rules improve.
GeminiSupported
GitHub CopilotSupportedTell us and a person on the trust team will look at it. Or email [email protected].
Nobody has shared how they use Testing Handbook Skills yet.
Security scan
Passed
Safe to install in every agent it supports. Runs in your agent, as instructions.
Skills people install alongside Testing Handbook Skills.
Lets your agent find vulnerabilities in your code, prove they're real against your running app, and fix them: SCA, secrets, SAST and DAST.
Has your agent diff two Windows builds with WinDiff and explain what changed in syscalls, symbols and mitigations, and why it matters.
