testing-fuzzing
Made by JeffDesign and implement fuzzing harnesses for crash discovery, security auditing, and correctness verification. Coverage-guided, structure-aware, differential, grammar-based, stateful, network-protocol, and web-API fuzzing across Rust, Go, C/C++, Java, Python, TypeScript. Use when: testing parsers, protocols, serialization, cryptography, state machines, file formats, APIs, or any input-processing code.
Works With
Quality and Utility come from canonical skill metadata. Community ratings appear separately as stars when subscriber reviews exist.
Subscribe to download
Public previews are available, but downloads, CLI sync, and premium content require an active subscription.
Sign In to Subscribe- Full skill content with deterministic versioning
- CLI sync + local search index
- Access to Jeffrey’s premium library
Save to your account
Saved skills live in your cloud list. Run jsm sync on each machine to pull them locally.
What's New with this Skill
2Updates, enhancements, and release notes for this skill.
testing-fuzzing: nearly 9x expansion, now covering 7 languages and 20 reference guides
The fuzzing skill went from about 1,700 lines to 14,800+. Covers Rust, Go, Python, TypeScript, C/C++, Java, and Solidity with 42 copy-paste harness templates, 19 ready-to-use dictionaries, and new guides for AFL++ internals, network protocol fuzzing, cloud fuzzing at scale, and making unfuzzable code fuzzable.
- 42 copy-paste harness templates across 7 archetypes and 6 languages
- 19 ready-to-use fuzzing dictionaries for JSON, XML, SQL, HTTP, protobuf, and 14 more formats
- New FUZZER-INTERNALS.md explaining how coverage feedback actually works under the hood
- New FUZZABILITY.md with refactoring patterns to make unfuzzable code fuzzable
- 877-line AFL++ deep guide: CMPLOG, persistent mode, power schedules, QEMU, custom mutators
- Network protocol fuzzing: TCP, gRPC, WebSocket, REST APIs, GraphQL
- Cloud fuzzing at scale: cost estimation, spot instances, ClusterFuzz architecture
- Polyglot setup script that checks fuzzing readiness for Rust, Go, Python, TS, C++, and Java
The testing-fuzzing skill was already solid for Rust cargo-fuzz work, but it told you almost nothing about Go, Python, TypeScript, C++, or Java. Now it does.
What changed:
- 23 files, up from 10. 14,824 lines, up from 1,681.
- 42 harness templates: 7 archetypes (crash, round-trip, differential, stateful, grammar, custom mutator, concurrency) across 6 languages, all copy-paste ready.
- 19 fuzzing dictionaries: JSON, XML, SQL, HTTP, TLS, PNG, ELF, WASM, PDF, protobuf, GraphQL, JWT, and more.
New skill: Fuzzing
Design and implement fuzzing harnesses that find crashes, memory bugs, and security vulnerabilities by throwing intelligent random inputs at parsers, protocols, and state machines.
- 7 harness archetypes with copy-paste code: all in Rust, with Go, Python (Atheris), and TypeScript (Jazzer.js) versions of the common ones
- Sanitizer integration guide: ASan + UBSan minimum, MSan for unsafe, TSan for concurrent code
- Corpus engineering: seed construction, dictionary files, minimization, plateau diagnosis
- Bolero unified framework: write one harness, run with libFuzzer, AFL++, or honggfuzz
- Real-world evidence: OSS-Fuzz has found 13,000+ vulnerabilities across 1,000+ projects
Coverage-guided fuzzing finds security vulnerabilities and reliability bugs in input-processing code that example-based tests miss. This skill covers 7 harness archetypes (crash detection, round-trip, differential, stateful, grammar-based, custom mutator, concurrency), sanitizer discipline (ASan/MSan/TSan/UBSan), corpus engineering, and the complete fuzz-to-regression-test pipeline.