strace and ltrace skill for system call and library call tracing.

MITAuto-check passedDevelopment

Install Strace Ltrace

skills CLI
$ npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mohitmishra786/low-level-dev-skills strace-ltrace --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mohitmishra786/low-level-dev-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/profilers/strace-ltrace .claude/skills/strace-ltrace && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
strace-ltrace
GitHub stars
253
Token cost
~1.6k tokens
SKILL.md length
351 words
Files
2 (incl. references)
Skills in repo
138
Repo updated
First seen
Licence
MIT

At a glance

strace and ltrace skill for system call and library call tracing.

  • Works in 7 steps: Basic strace usage → Filter by syscall category → Interpreting common errors → …
  • A binary behaves incorrectly without crashing
  • SKILL.md covers Purpose, Triggers, Workflow and Related skills
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Strace Ltrace is an agent skill from mohitmishra786/low-level-dev-skills. strace and ltrace skill for system call and library call tracing. Use when a binary behaves incorrectly without crashing, diagnosing file-not-found errors, permission failures, network issues, or unexpected library calls by tracing syscalls and library function calls. Activates on queries about strace, ltrace, syscall tracing, library interception, ENOENT, EPERM, strace -e, or diagnosing binary behaviour without a debugger.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/strace-patterns.md`).

It sits in Development, covering Performance optimization. The repository describes itself as: A curated suite of AI agent skills for systems and low-level programming with C/C++, Rust, and Zig toolchains, covering compilers, debuggers, profilers, build systems…. The licence is MIT.

When your agent uses it

  • A binary behaves incorrectly without crashing
  • Diagnosing file-not-found errors
  • Permission failures
  • Unexpected library calls by tracing syscalls and library function calls

Example prompts

  • “/strace-ltrace”

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Basic strace usage
  2. Filter by syscall category
  3. Interpreting common errors
  4. Useful strace flags
  5. ltrace — library call tracing
  6. Practical diagnosis workflows
  7. seccomp filter debugging

What it can do on your machine

Read from SKILL.md and the folder at commit bdc5847. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Strace Ltrace loads about 1.6k tokens when it runs, and up to ~2.6k if it reads all its reference files. Until then it costs about 110 tokens; SKILL.md has 351 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~110
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from mohitmishra786/low-level-dev-skills at commit bdc5847, republished under its MIT licence (© mohitmishra786). 351 words, ~1,561 tokens.

Download SKILL.mdSave it as .claude/skills/strace-ltrace/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
strace-ltrace
description
strace and ltrace skill for system call and library call tracing. Use when a binary behaves incorrectly without crashing, diagnosing file-not-found errors, permission failures, network issues, or unexpected library calls by tracing syscalls and library function calls. Activates on queries about strace, ltrace, syscall tracing, library interception, ENOENT, EPERM, strace -e, or diagnosing binary behaviour without a debugger.

strace / ltrace

Purpose

Guide agents through tracing system calls with strace and library calls with ltrace — the most effective tools for diagnosing incorrect binary behaviour without a crash or debugger.

Triggers

  • "My program behaves incorrectly — how do I trace what it's doing?"
  • "How do I find what files a binary is opening?"
  • "strace shows ENOENT — how do I interpret it?"
  • "How do I trace network calls with strace?"
  • "What is ltrace and how does it differ from strace?"
  • "How do I trace a running process?"

Workflow

1. Basic strace usage
bash
# Trace all syscalls of a command
strace ./myapp arg1 arg2

# Attach to running process
strace -p 12345

# Trace child processes too (-f = follow fork)
strace -f ./myapp

# Save to file (raw output — not stdout)
strace ./myapp 2> trace.txt

# Most useful: timestamps + summary
strace -t -f ./myapp 2>&1 | head -100
2. Filter by syscall category
bash
# Trace file operations only
strace -e trace=file ./myapp

# Trace network syscalls
strace -e trace=network ./myapp

# Trace specific syscalls
strace -e trace=open,openat,read,write ./myapp

# Trace process management
strace -e trace=process ./myapp

# Trace memory operations
strace -e trace=memory ./myapp

# Trace signals
strace -e trace=signal ./myapp

# Multiple categories
strace -e trace=file,network ./myapp
CategorySyscalls included
fileopen, openat, stat, access, unlink, rename, ...
networksocket, connect, bind, accept, send, recv, ...
processfork, exec, wait, clone, exit, ...
memorymmap, munmap, mprotect, brk, ...
signalkill, sigaction, sigprocmask, ...
ipcpipe, socket pair, shmget, ...
descclose, dup, poll, select, epoll, ...
3. Interpreting common errors
bash
# See return values and errors
strace -e trace=file ./myapp 2>&1 | grep -E "ENOENT|EPERM|EACCES|ENOTSUP"
ErrorMeaningCommon cause
ENOENTNo such file or directoryConfig file missing, wrong path
EACCESPermission deniedFile permissions, SELinux
EPERMOperation not permittedMissing capability, suid needed
EADDRINUSEAddress already in usePort already bound
ETIMEDOUTConnection timed outNetwork unreachable, firewall
ECONNREFUSEDConnection refusedServer not listening
EAGAINResource temporarily unavailableNon-blocking I/O, try again
ENOMEMOut of memoryAllocation failed
EBADFBad file descriptorUsing closed/invalid fd
ENOEXECExec format errorWrong binary format for arch
bash
# Find what file is not found
strace ./myapp 2>&1 | grep 'ENOENT'
# Example output:
# openat(AT_FDCWD, "/etc/myapp.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
# → Config file expected at /etc/myapp.conf
Show full SKILL.md (129 more words)Show less
4. Useful strace flags
bash
# Show strings fully (default truncates at 32 chars)
strace -s 256 ./myapp

# Timestamps
strace -t ./myapp     # wall clock time
strace -T ./myapp     # time spent in each syscall
strace -r ./myapp     # relative timestamps

# System call count summary
strace -c ./myapp
# Shows count, time, errors per syscall — great for profiling

# Trace with PIDs in output (for -f)
strace -f -p ./myapp
# Output: [pid 12346] open("/etc/passwd", O_RDONLY) = 3

# Decode numerical arguments
strace -e verbose=all ./myapp

# Print instruction pointer at each syscall
strace -i ./myapp
5. ltrace — library call tracing
bash
# Trace all library calls
ltrace ./myapp

# Trace specific library function
ltrace -e malloc,free,fopen ./myapp

# Trace nested calls (lib → lib)
ltrace -n 2 ./myapp   # indent nested calls

# Trace with syscalls too
ltrace -S ./myapp

# Attach to running process
ltrace -p 12345

# Summary statistics
ltrace -c ./myapp

Typical ltrace output:

text
malloc(1024) = 0x55a1b2c3d000
fopen("/etc/myapp.conf", "r") = 0
free(0x55a1b2c3d000) = <void>

strace vs ltrace:

straceltrace
TracesKernel syscallsUser-space library calls
OverheadLowerHigher (PLT hooking)
Showsopen(), read(), write()fopen(), malloc(), printf()
Use whenBinary interacts with OS/files/networkBinary calls library functions you can't see
6. Practical diagnosis workflows
bash
# Find missing config file
strace -e trace=openat,open ./myapp 2>&1 | grep ENOENT

# Find what network connections are made
strace -e trace=network -f ./myapp 2>&1 | grep connect

# Debug dynamic library loading failures
strace -e trace=openat ./myapp 2>&1 | grep "\.so"

# Find permission issues
strace -e trace=file ./myapp 2>&1 | grep -E "EACCES|EPERM"

# Debug slow startup (find where time is spent)
strace -c ./myapp 2>&1
# Look for high % time in unexpected syscalls

# Watch IPC/shared memory
strace -e trace=ipc,shm ./myapp

# Find what the binary exec's
strace -e trace=execve -f ./myapp
7. seccomp filter debugging

If a program is killed by a seccomp policy, strace reveals which syscall triggered it:

bash
strace -e trace=all ./myapp 2>&1 | tail -5
# Often shows the last syscall before SIGSYS

For strace output patterns and ltrace filtering examples, see references/strace-patterns.md.

  • Use skills/debuggers/gdb when strace shows the failing location and you need to inspect internals
  • Use skills/binaries/elf-inspection to understand what libraries and symbols a binary uses
  • Use skills/binaries/dynamic-linking for diagnosing LD_* and library loading issues
  • Use skills/profilers/linux-perf for performance profiling (strace overhead is too high for perf)

© mohitmishra786, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/profilers/strace-ltrace of mohitmishra786/low-level-dev-skills.

  • SKILL.md
  • references/strace-patterns.md

Open the folder on GitHubat commit bdc5847

Compare with similar skills

Strace Ltrace next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Strace Ltrace compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Strace Ltrace this skillmohitmishra786/low-level-dev-skills253—~1.6kAutomated safety check: PassMIT
Code Review ChecklistshareAI-lab/learn-claude-code78k5 repos~1.1kAutomated safety check: PassMIT
LLM Torch Profiler Analysissgl-project/sglang37k2 repos~6.4kAutomated safety check: PassApache-2.0
Pycrazyguitar/pysheeet8.2k—~886Automated safety check: PassMIT
Cmux Debugging Guidemanaflow-ai/cmux28k1 repos~1.1kAutomated safety check: PassCustom licence
Electron Heap Snapshot Analysiskeybase/client9.3k—~875Automated safety check: PassBSD-3-Clause

Similar skills

  • Code Review Checklist

    shareAI-lab/learn-claude-code

    Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.

    78k GitHub starsUsed in 5 repos~1.1k tokens
    DevelopmentAuto-check passed
  • LLM Torch Profiler Analysis

    sgl-project/sglang

    Unified LLM torch-profiler triage skill for sglang, vllm, TensorRT-LLM, and TokenSpeed.

    37k GitHub starsUsed in 2 repos~6.4k tokens
    DevelopmentAuto-check passed
  • Py

    crazyguitar/pysheeet

    Comprehensive Python programming reference covering syntax, concurrency, networking, databases, ML/LLM development, and HPC.

    8.2k GitHub stars~886 tokensUpdated 2 days ago
    DevelopmentAuto-check passed
  • Cmux Debugging Guide

    manaflow-ai/cmux

    Covers debug logging, the Debug menu, profiling rules and runtime pitfalls for working on the cmux macOS terminal app.

    28k GitHub starsUsed in 1 repo~1.1k tokens
    DevelopmentAuto-check passed
  • Analyzes V8, Chrome and Electron .heapsnapshot files with Node scripts to find memory leaks, detached DOM nodes and the retainer paths that keep objects alive.

    9.3k GitHub stars~875 tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Runs controlled JMH experiments on the Caffeine cache to find shared contention and hot-path waste, then reviews correctness and returns a reviewable patch.

    18k GitHub stars~2.6k tokensUpdated today
    DevelopmentAuto-check: notes

More from mohitmishra786/low-level-dev-skills

All 138 skills in this repo
  • ARM and AArch64 Assembly

    mohitmishra786/low-level-dev-skills

    Guides reading and writing AArch64 and ARM Thumb assembly: compiler output, inline asm, registers, the AAPCS calling convention and NEON or SVE basics.

    253 GitHub stars~1.9k tokensUpdated 3 mo ago
    Auto-check passed
  • RISC-V Assembly Guide

    mohitmishra786/low-level-dev-skills

    Reference for RISC-V assembly on RV32 and RV64: register names and calling convention, extension naming, GCC and Clang inline asm, and QEMU with GDB debugging.

    253 GitHub stars~1.8k tokensUpdated 3 mo ago
    Auto-check passed
  • x86-64 Assembly Reference

    mohitmishra786/low-level-dev-skills

    Explains x86-64 registers, the System V AMD64 calling convention, and how to read compiler-generated or inline assembly.

    253 GitHub stars~1.5k tokensUpdated 3 mo ago
    Auto-check passed
  • Bazel for C and C++

    mohitmishra786/low-level-dev-skills

    Guides your agent through Bazel for C/C++ projects: BUILD files, Bzlmod dependencies, toolchain registration, remote execution, dependency queries and sandbox debugging.

    253 GitHub stars~1.5k tokensUpdated 3 mo ago
    Auto-check passed
  • Binary Hardening

    mohitmishra786/low-level-dev-skills

    Binary hardening skill for security-hardened C/C++ builds. An agent skill from mohitmishra786/low-level-dev-skills.

    253 GitHub stars~2k tokensUpdated 3 mo ago
    Auto-check passed
  • Binutils

    mohitmishra786/low-level-dev-skills

    GNU binutils skill for binary manipulation and analysis. An agent skill from mohitmishra786/low-level-dev-skills.

    253 GitHub stars~1.2k tokensUpdated 3 mo ago
    Auto-check passed

Categories

Questions about Strace Ltrace

What does Strace Ltrace do?

strace and ltrace skill for system call and library call tracing. Strace Ltrace is an agent skill from mohitmishra786/low-level-dev-skills. strace and ltrace skill for system call and library call tracing.

When should I use Strace Ltrace?

Strace Ltrace fits situations like: A binary behaves incorrectly without crashing; diagnosing file-not-found errors; permission failures; unexpected library calls by tracing syscalls and library function calls.

How do I install Strace Ltrace in Claude Code?

Run `npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a claude-code`. Or copy the skill folder (skills/profilers/strace-ltrace in mohitmishra786/low-level-dev-skills) into .claude/skills/strace-ltrace in your project. Claude Code loads it when a task matches its description.

How do I install Strace Ltrace in Codex?

Run `npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a codex`. Or copy the skill folder (skills/profilers/strace-ltrace in mohitmishra786/low-level-dev-skills) into .agents/skills/strace-ltrace in your project. Codex loads it when a task matches its description.

Can I use Strace Ltrace in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mohitmishra786/low-level-dev-skills --skill strace-ltrace -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/strace-ltrace, .gemini/skills/strace-ltrace, .github/skills/strace-ltrace and .opencode/skills/strace-ltrace in your project.

What does Strace Ltrace need to run?

SKILL.md names no scripts, command-line tools or credentials: Strace Ltrace is instructions for the agent only.

Does Strace Ltrace access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Strace Ltrace safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Strace Ltrace use?

Strace Ltrace is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Strace Ltrace use?

About 1.6k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.1k tokens, read only when the agent opens those files.

What are the alternatives to Strace Ltrace?

Skills that share tags, products or a category with Strace Ltrace: Code Review Checklist (shareAI-lab/learn-claude-code, 78k stars), LLM Torch Profiler Analysis (sgl-project/sglang, 37k stars), Py (crazyguitar/pysheeet, 8.2k stars) and Cmux Debugging Guide (manaflow-ai/cmux, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Strace Ltrace?

mohitmishra786 (a GitHub user) maintains it in mohitmishra786/low-level-dev-skills, which has 253 GitHub stars. The repository holds 138 skills in this directory. The repository was last updated on June 27, 2026.

Source: mohitmishra786/low-level-dev-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.