atheris

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The Dockerfile configuration fetches LLVM toolchains and GPG keys from the official LLVM project repository (apt.llvm.org), which is a well-known and trusted service for development tools.
  • [COMMAND_EXECUTION]: The skill provides standard shell commands for installation and environment setup using tools like uv, pip, apt, and docker. These commands are necessary for the documented purpose of setting up a fuzzing environment.
  • [SAFE]: The use of LD_PRELOAD for asan_with_fuzzer.so is a documented requirement for Atheris to correctly intercept memory allocations when fuzzing native C extensions with AddressSanitizer. In this context, it is a legitimate security testing configuration rather than a malicious injection technique.
  • [SAFE]: The skill instructs the user to install common Python packages like atheris, urllib3, and cbor2 from standard registries. These are well-established libraries in the Python ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 10:18 PM
Security Audit — agent-trust-hub — atheris