Is libafl safe?
Grade C, 74/100. Review before installing.
Builds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into a fuzzer for targets the standard tools do not fit. Use when writing a bespoke fuzzer or mutator, fuzzing a non-standard target or architecture, implementing a fuzzing research idea, or when libFuzzer and AFL++ lack the control you need.
Clibafl
plugins/testing-handbook-skills/skills/libafl74/100 · Review before installing1 high1 low
libafl
plugins/testing-handbook-skills/skills/libaflBuilds custom fuzzers with LibAFL, the modular Rust fuzzing library. Covers composing observers, feedbacks, mutators, schedulers, and executors into a fuzzer for targets the standard tools do not fit. Use when writing a bespoke fuzzer or mutator, fuzzing a non-standard target or architecture, implementing a fuzzing research idea, or when libFuzzer and AFL++ lack the control you need.
- Content hash
- sha256:d0b9b1c7b24da1e20857f88c211dc939cad56bd8fecea1b0b234040bd8bfc29a
- Files
- 3
- Quality
- 100/100
Security findings
- highPipes a download into a shellSL301 · plugins/testing-handbook-skills/skills/libafl/SKILL.md:82
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | shRemote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine. Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill.
- lowRuns with elevated privilegesSL305 · plugins/testing-handbook-skills/skills/libafl/SKILL.md:70
sudo ./llvm.sh 15The skill uses sudo. Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.
Quality
- infoSKILL.md is longSL705 · plugins/testing-handbook-skills/skills/libafl/SKILL.md:1
624 linesLong skills spend context on every load. Fix: Keep SKILL.md under 500 lines and move reference material into linked files.
Files in this skill
- SKILL.md16.7 KB
- agents/openai.yaml228 B
- assets/trail-of-bits-mark.svg3.0 KB
Questions about libafl
- Is libafl safe to install?
- Our scanner gave libafl grade C (74/100): review before installing. It matched 2 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install libafl in Claude Code or Codex?
- Run skillhash add github:trailofbits/skills/plugins/testing-handbook-skills/skills/libafl. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if libafl changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from trailofbits/skills
- A
guidelines-advisor
7.6ktrailofbits/skills
Smart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.
No security findings - A
secure-workflow-guide
7.6ktrailofbits/skills
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.
No security findings - A
algorand-vulnerability-scanner
7.6ktrailofbits/skills
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
No security findings - A
audit-prep-assistant
7.6ktrailofbits/skills
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.
No security findings - A
cairo-vulnerability-scanner
7.6ktrailofbits/skills
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
No security findings - A
code-maturity-assessor
7.6ktrailofbits/skills
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.
No security findings - A
cosmos-vulnerability-scanner
7.6ktrailofbits/skills
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
No security findings - A
solana-vulnerability-scanner
7.6ktrailofbits/skills
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.
No security findings