coverage-analysis

Analyze code coverage from fuzzing campaigns using llvm-cov or gcovr.

Updated Jan 30, 2026
One-click install
npx skills add https://github.com/andrescardonas7/salchipapa-web --skill coverage-analysis-andrescardonas7
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: coverage-analysis
Source: https://github.com/andrescardonas7/salchipapa-web/tree/main/.cursor/skills/testing-handbook-skills/coverage-analysis
Command: npx skills add https://github.com/andrescardonas7/salchipapa-web --skill coverage-analysis-andrescardonas7

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you understand which parts of your code are being exercised by your fuzzing harnesses and identify areas that are not being tested, allowing you to improve your fuzzing efforts.

Core Features & Use Cases

  • Harness Effectiveness: Assess how well your fuzzing harnesses are covering the intended code paths.
  • Fuzzing Blockers: Identify potential issues like magic value checks that prevent the fuzzer from reaching certain code sections.
  • Progress Tracking: Monitor improvements in code coverage as you refine your harnesses or fuzzers.
  • Use Case: After running a fuzzing campaign for a week, you can use this Skill to generate a coverage report that highlights which functions were never called, prompting you to write new test cases or adjust your fuzzing strategy.

Quick Start

Build your project with coverage instrumentation and then run the coverage analysis tool to generate a report.

Frequently Asked Questions about coverage-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze code coverage during a fuzzing campaign?

Code coverage during fuzzing is analyzed by building the target with specific compiler flags for coverage instrumentation, then processing the generated profile data using tools like llvm-cov or gcovr to assess harness effectiveness.

Why does my fuzzer progress plateau and how can I identify fuzzing blockers?

Fuzzer progress plateaus when code paths are unreachable; analyzing code coverage identifies fuzzing blockers like magic value checks that prevent the fuzzer from reaching certain code sections, allowing you to adjust your strategy.

How do I assess fuzzing harness effectiveness using gcovr or llvm-cov?

Harness effectiveness is assessed by running coverage analysis tools like llvm-cov or gcovr on profile data generated during fuzzing to understand which code paths are exercised and which functions are never called.

Do I need specific compiler flags to generate code coverage profile data for fuzzing?

Yes, specific compiler flags for coverage instrumentation are required to build the target before fuzzing, enabling the generation of profile data needed to assess fuzzing progress and identify untested areas.

Can I monitor improvements in code coverage as I refine my fuzzing harnesses?

You can monitor code coverage improvements by generating coverage reports after refining your harnesses or fuzzers, tracking which newly added code paths are exercised and identifying remaining untested functions.

What is the best way to track which functions were never called during fuzzing?

The best way to track uncalled functions is to generate a coverage report from profile data using llvm-cov or gcovr, highlighting areas not exercised to prompt new test cases or harness adjustments.