skills.rest
amano--
amano--COMMUNITY
Explore all skills by this author →
WebsiteGitHub

coverage-analysis

Measure code coverage during fuzzing campaigns with LLVM and GCC instrumentation.

Updated Jan 24, 2026
Search Tags:#testing#code analysis#coverage#llvm#fuzzing#gcc
One-click install
npx skills add https://github.com/amano--/call-center --skill coverage-analysis-amano
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coverage-analysis
Source: https://github.com/amano--/call-center/tree/main/.gemini/antigravity/skills/trailofbits-security/coverage-analysis
Command: npx skills add https://github.com/amano--/call-center --skill coverage-analysis-amano

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you understand which parts of your code are being executed during fuzzing, identify areas that are not being reached, and assess the effectiveness of your fuzzing harnesses.

Core Features & Use Cases

  • Code Coverage Measurement: Instrument your code to track execution paths.
  • Report Generation: Create detailed reports (text or HTML) of code coverage.
  • Fuzzing Blocker Identification: Detect issues like magic value checks that prevent fuzzers from reaching certain code paths.
  • Use Case: After a fuzzing campaign, you want to know if your harness is effectively exercising the target code. You use this Skill to generate a coverage report, revealing that a specific error-handling path is never hit, indicating a potential harness improvement or a need for better seed inputs.

Quick Start

Use the coverage-analysis skill to build your C++ project with LLVM coverage instrumentation and generate an HTML report for the corpus in the 'corpus/' directory.

Frequently Asked Questions about coverage-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I measure code coverage during a fuzzing campaign?▼

To measure code coverage during fuzzing, you build instrumented binaries with LLVM or GCC, execute them against a corpus, and generate detailed reports to identify reached and unreached code paths.

How do I generate an HTML coverage report for a C++ fuzzing corpus?▼

You can generate an HTML coverage report for a C++ fuzzing corpus by compiling the project with LLVM coverage instrumentation, running the binary against the corpus, and exporting the execution data into HTML format.

Why does my fuzzer fail to reach certain code paths during testing?▼

Fuzzers fail to reach certain code paths due to blockers like magic value checks. Analyzing code coverage detects these unreached areas, indicating a need for harness improvements or better seed inputs to bypass constraints.

Does this coverage analysis approach work with CMake build systems?▼

Yes, this coverage analysis approach works with CMake build systems, detailing how to integrate LLVM and GCC instrumentation into your build configuration to compile instrumented binaries for fuzzing campaigns.

How do I handle crashing inputs when generating code coverage reports?▼

Handling crashing inputs during code coverage report generation is a common challenge addressed by the technique, providing strategies to manage crashing test cases so you can execute binaries and collect coverage data.

Related Skills

Explore More Software Engineering Skills→
elizaOSelizaOS
19.0k

coverage-analysis

Analyze code coverage from fuzzing campaigns using llvm-cov and gcovr.

Official
Intermediate
mejangomejango

coverage-analysis

Identify unexercised code paths during fuzzing campaigns using LLVM coverage tools.

Community
Advanced
SuperlendSuperlend

coverage-analysis

Analyze code coverage from fuzzing campaigns and generate reports with LLVM tools.

Official
Intermediate
RektooooooRektoooooo
2

swift-architecture

Automate Swift code reviews and architecture analysis with static analysis tools.

Community
Intermediate