What problem does it solve? Fuzzing campaigns often plateau without revealing which code paths are actually exercised, leaving harness weaknesses and magic value blockers invisible. This Skill provides a repeatable workflow to instrument builds, execute corpora, and generate coverage reports that expose untested code. ## Core Features & Use Cases - Multi-toolchain instrumentation: Build coverage binaries with LLVM (-fprofile-instr-generate -fcoverage-mapping), GCC (-ftest-coverage -fprofile-arcs), or Rust's cargo +nightly fuzz coverage. - Report generation: Produce text and HTML reports with llvm-cov, gcovr, and llvm-profdata, filtering out harness code to focus on the system under test. - Blocker identification: Detect magic value checks, dead code, and coverage regressions, then feed findings into dictionaries or seed inputs. - Use Case: After a libFuzzer campaign stalls, build a coverage-instrumented binary, run it against the corpus, and generate an HTML report revealing an ELF magic-number check that needs a dictionary entry. ## Quick Start Ask the AI to generate an LLVM coverage report for your fuzzing corpus by building an instrumented binary and running llvm-cov against the collected profile data.
