coverage-analysis

Measure code exercised during fuzzing with LLVM, GCC/gcov, and cargo-fuzz instrumentation.

6.5k|561|Updated Jan 14, 2026

Search Tags:#reporting #instrumentation #coverage #llvm #fuzzing #harness

Ready to run

npx skills add https://github.com/trailofbits/skills --skill coverage-analysis-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: coverage-analysis
Source: https://github.com/trailofbits/skills/tree/main/plugins/testing-handbook-skills/skills/coverage-analysis
Command: npx skills add https://github.com/trailofbits/skills --skill coverage-analysis-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Coverage analysis makes it possible to measure which parts of your code are exercised during fuzzing, helping you identify blockers and assess harness effectiveness over time.

Core Features & Use Cases

Instrumentation for coverage tracking (LLVM SanitizerCoverage, GCC/gcov, or Rust tooling)
Coverage reporting to identify uncovered paths, magic value checks, and dead code
Use cases include baseline fuzz campaigns, regression testing, and CI-configured coverage workflows

Quick Start

Run a coverage-enabled fuzzing workflow by instrumenting your build, executing the fuzzer with a corpus, and generating a report to guide harness improvements.

Frequently Asked Questions about coverage-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I measure code coverage during fuzzing?▼

Fuzzing coverage is measured by instrumenting builds with LLVM SanitizerCoverage, GCC/gcov, or Rust tooling, then executing the fuzzer and generating reports to identify exercised code paths.

Can I use cargo-fuzz workflows to generate Rust coverage reports?▼

Yes, cargo-fuzz workflows are supported for Rust fuzzing projects, allowing you to instrument builds, execute fuzzers with a corpus, and generate coverage reports to guide harness improvements.

What's the best way to identify uncovered paths and dead code in a fuzz campaign?▼

Coverage reporting via llvm-cov, gcovr, and related tooling identifies uncovered paths, magic value checks, and dead code by analyzing instrumented fuzzer execution data across C/C++ and Rust projects.

Does coverage analysis work with both LLVM and GCC instrumentation?▼

Yes, coverage analysis supports LLVM-based instrumentation and GCC/gcov workflows, enabling you to track code exercised during fuzzing across multi-language projects and CI environments.

Why does my fuzzing harness miss certain code paths?▼

Coverage analysis identifies blockers and measures harness effectiveness by revealing gaps in exercised code, helping you tune harnesses to reach uncovered paths and magic value checks.

How do I integrate fuzzing coverage workflows into CI?▼

CI-configured coverage workflows are established by instrumenting builds, executing fuzzers with a corpus, and generating coverage reports to guide harness tuning and verify effectiveness over time.