# testing-handbook-skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

- **Kind:** plugin (installs as one bundle)
- **Owner:** trailofbits
- **Source:** https://github.com/trailofbits/skills (`plugins/testing-handbook-skills`)
- **Pinned commit:** `d3323cefbcf645678b8dc481de204b02ad3d02dc`
- **Page:** https://forefy.com/plugins/45556276-71ba-5ebb-b635-8cbef888ab10
- **API (JSON):** https://forefy.com/api/asr/plugins/45556276-71ba-5ebb-b635-8cbef888ab10

## Install

Ask your agent: `Install the testing-handbook-skills plugin securely from: https://forefy.com/plugins/45556276-71ba-5ebb-b635-8cbef888ab10 globally to ~/.claude/skills`

Or run the pinned install script: `curl -fsSL https://forefy.com/api/asr/plugins/45556276-71ba-5ebb-b635-8cbef888ab10/install | bash` (`?location=project` for the current project, `&shell=powershell` with `irm ... | iex`; `harness=agents` prints the Codex commands).

## Skills in this plugin (15)

- [harness-writing](https://forefy.com/skills/472fcba5-222d-4580-a98e-fffb8bf734cf): Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism a…
- [constant-time-testing](https://forefy.com/skills/dd098143-5910-49dd-a16f-97421f157533): Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tra…
- [cargo-fuzz](https://forefy.com/skills/5a7741cb-60e2-4b35-bee3-fd042bfeb81b): Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! h…
- [address-sanitizer](https://forefy.com/skills/1bf6aa50-783a-4b3e-980e-bc15cf5fd64a): Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=addre…
- [libafl](https://forefy.com/skills/d82e4280-69ce-45bf-9a1d-d07f8eb16c23): Builds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into a fuzzer f…
- [aflpp](https://forefy.com/skills/d41b9ac2-5089-4a6c-867a-aa7a9344b799): Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and seco…
- [atheris](https://forefy.com/skills/b53f18dc-0abc-4e49-bd73-bd9a99c6d98d): Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Pyth…
- [coverage-analysis](https://forefy.com/skills/e6869abd-c8bd-4e55-bca8-2404feb31e41): Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, re…
- [fuzzing-dictionary](https://forefy.com/skills/c61fbbdd-c531-46e2-b8fb-e8674c994e7e): Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, h…
- [fuzzing-obstacles](https://forefy.com/skills/f9b1013f-d398-4b58-ad0d-97645f1e3d02): Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-determin…
- [libfuzzer](https://forefy.com/skills/b23ce9d5-534b-44a8-bc37-cdb9861c6942): Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer bui…
- [ossfuzz](https://forefy.com/skills/bd42450e-3f95-4cd4-b289-d51e52a73956): Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh se…
- [ruzzy](https://forefy.com/skills/f7e22594-acae-4502-a3cc-25f8a62859c4): Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure R…
- [testing-handbook-generator](https://forefy.com/skills/e3e9b952-69f9-45e0-8351-95f06ad1552d): Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure ea…
- [wycheproof](https://forefy.com/skills/4ee63075-fedb-488d-b252-1cc4275a4403): Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and…