coverage-analysis

Name: coverage-analysis
Availability: InStock
Author: amano

Measure code coverage during fuzzing campaigns with LLVM and GCC instrumentation.

Updated Jan 24, 2026

Search Tags:#testing #code analysis #coverage #llvm #fuzzing #gcc

Ready to run

npx skills add https://github.com/amano--/call-center --skill coverage-analysis-amano

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: coverage-analysis
Source: https://github.com/amano--/call-center/tree/main/.gemini/antigravity/skills/trailofbits-security/coverage-analysis
Command: npx skills add https://github.com/amano--/call-center --skill coverage-analysis-amano

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you understand which parts of your code are being executed during fuzzing, identify areas that are not being reached, and assess the effectiveness of your fuzzing harnesses.

Core Features & Use Cases

Code Coverage Measurement: Instrument your code to track execution paths.
Report Generation: Create detailed reports (text or HTML) of code coverage.
Fuzzing Blocker Identification: Detect issues like magic value checks that prevent fuzzers from reaching certain code paths.
Use Case: After a fuzzing campaign, you want to know if your harness is effectively exercising the target code. You use this Skill to generate a coverage report, revealing that a specific error-handling path is never hit, indicating a potential harness improvement or a need for better seed inputs.

Quick Start

Use the coverage-analysis skill to build your C++ project with LLVM coverage instrumentation and generate an HTML report for the corpus in the 'corpus/' directory.

Frequently Asked Questions about coverage-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I measure code coverage during a fuzzing campaign?▼

To measure code coverage during fuzzing, you build instrumented binaries with LLVM or GCC, execute them against a corpus, and generate detailed reports to identify reached and unreached code paths.

How do I generate an HTML coverage report for a C++ fuzzing corpus?▼

You can generate an HTML coverage report for a C++ fuzzing corpus by compiling the project with LLVM coverage instrumentation, running the binary against the corpus, and exporting the execution data into HTML format.

Why does my fuzzer fail to reach certain code paths during testing?▼

Fuzzers fail to reach certain code paths due to blockers like magic value checks. Analyzing code coverage detects these unreached areas, indicating a need for harness improvements or better seed inputs to bypass constraints.

Does this coverage analysis approach work with CMake build systems?▼

Yes, this coverage analysis approach works with CMake build systems, detailing how to integrate LLVM and GCC instrumentation into your build configuration to compile instrumented binaries for fuzzing campaigns.

How do I handle crashing inputs when generating code coverage reports?▼

Handling crashing inputs during code coverage report generation is a common challenge addressed by the technique, providing strategies to manage crashing test cases so you can execute binaries and collect coverage data.