Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.
Install
npx skills add trailofbits/skills --skill coverage-analysisnpx skills add trailofbits/skills --skill coverage-analysis -a claude-code -gnpx skills add trailofbits/skills --skill coverage-analysis -a codex -ggemini skills install https://github.com/trailofbits/skills.git --path plugins/testing-handbook-skills/skills/coverage-analysisgh skill install trailofbits/skills coverage-analysisgit clone --depth 1 https://github.com/trailofbits/skills /tmp/trailofbits__skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/trailofbits__skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.claude/skills/coverage-analysis # Claude Code
cp -R /tmp/trailofbits__skills/plugins/testing-handbook-skills/skills/coverage-analysis ~/.agents/skills/coverage-analysis # Codex, Cursor, Gemini CLI, Copilot, OpenCode