CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/libfuzzer-cpp

Author and run LLVM libFuzzer for C/C++ - in-process coverage-guided fuzzing. Covers harness authoring (LLVMFuzzerTestOneInput entry point), build with -fsanitize=fuzzer,address,undefined, runtime flags (-max_total_time, -runs, -dict, -fork, -workers), corpus + crash-artefact handling, and CI integration. Use for libraries / parsers / decoders in C/C++ where in-process fuzzing of a function is the right scope. Compose with ASan + UBSan from sanitiser-integration-reference and corpus discipline from corpus-management-reference.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable skill body with executable code throughout, a well-sequenced fuzz→reproduce→minimize workflow with validation, and clean one-level-deep reference disclosure. The only weakness is minor explanatory prose that restates libFuzzer basics Claude already knows.

Suggestions

Trim the framing sentences under 'The fuzz target' ("The fuzzer calls this function repeatedly with mutated Data... let sanitisers + asserts catch bugs") to just the signature constraint and a pointer to the examples, since how libFuzzer drives the entry point is knowledge Claude already has.

The Overview's 'Composes with' bullet list duplicates the same reference pointers already made later (Build, Running, References); consider collapsing the Overview to a one-line scope statement and relying on those inline links.

The 'Tips for an effective target' table's 'Why' column occasionally explains fuzzer fundamentals (e.g. "Cross-input contamination defeats coverage guidance"); keep the tip but shorten the rationale to the actionable reason a practitioner needs.

DimensionReasoningScore

Conciseness

The body is mostly lean and action-oriented, but sentences like "The fuzzer calls this function repeatedly with mutated Data. The target's job is to drive the library code under test and let sanitisers + asserts catch bugs" restate how libFuzzer works — a concept Claude already knows — and could be trimmed.

2 / 3

Actionability

Provides fully executable build/run/reproduce/minimize commands, complete harness and FuzzedDataProvider code, and a copy-paste CI YAML; guidance is concrete rather than abstract.

3 / 3

Workflow Clarity

The author→build→run→reproduce→minimize flow is clearly sequenced, and the reproduce section includes an explicit validation checkpoint ("Verify: confirm the replay prints the same sanitiser bug class... If it does not reproduce... rebuild the target and re-run before proceeding").

3 / 3

Progressive Disclosure

The overview spine points one level deep to the real references/flags-and-ci.md (verified present) for the full flag table and CI job, with clearly signaled markdown links and content appropriately split between spine and reference.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, complete, and well-scoped description that names concrete capabilities, gives an explicit use-trigger, and is clearly distinguishable from sibling fuzzing skills. It stays in third person and avoids fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — "Author and run LLVM libFuzzer", "harness authoring (LLVMFuzzerTestOneInput entry point)", "build with -fsanitize=fuzzer,address,undefined", "corpus + crash-artefact handling", and "CI integration" — rather than vague language.

3 / 3

Completeness

Explicitly answers what (author/run, harness, build, flags, corpus, CI) and when ("Use for libraries / parsers / decoders in C/C++ where in-process fuzzing of a function is the right scope") with an explicit trigger clause.

3 / 3

Trigger Term Quality

Uses natural developer-facing terms — "fuzzing", "libFuzzer", "libraries / parsers / decoders", "C/C++" — that a user would actually say when needing this skill, with good coverage of variations.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear in-process C/C++ libFuzzer niche and names siblings (afl-plus-plus, cargo-fuzz-rust) plus a dispatcher (fuzz-tool-selector), making conflict with adjacent skills unlikely.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents