How do I install the Oss Fuzz skill?

Run npx skillmds@latest add aeondave/oss-fuzz in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Oss Fuzz safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Oss Fuzz?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Oss Fuzz free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Oss Fuzz?

AeonDave (@aeondave) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Oss Fuzz by aeondave — Agent Skill

Name: Oss Fuzz
Author: AeonDave

File contents

oss-fuzz

Continuous fuzzing platform that runs supported engines (libFuzzer, AFL++, Honggfuzz, Centipede) at scale.

When to Use

You maintain an open-source project and need persistent fuzz coverage.
You want automated sanitizer-based crash reporting and regression tracking.
You need multi-language support beyond ad-hoc local campaigns.

Core Flow

Add project integration config to OSS-Fuzz repo.
Define build/fuzz targets and seed corpora.
Validate locally with OSS-Fuzz tooling.
Submit and monitor issue stream.

Local Validation Flow

python3 infra/helper.py build_image <project>
python3 infra/helper.py build_fuzzers --sanitizer address <project>
python3 infra/helper.py check_build <project>
python3 infra/helper.py run_fuzzer --corpus-dir=<tmp-corpus> <project> <fuzz_target>

Run additional sanitizer/engine combinations when integration quality is uncertain.

Reproduction Flow (Bug Fix Loop)

python3 infra/helper.py reproduce <project> <fuzz_target> <testcase_path>

If the bug is not reproducible immediately:

pull latest images,
match sanitizer and architecture from report,
retry with exact target binary and runtime flags.

Practical Tricks

Keep seed corpus and dictionaries small but meaningful; large noisy corpora can slow signal.
Prefer statically linked fuzz binaries in build scripts for runtime compatibility.
Use Fuzz Introspector reports to detect low-reach fuzz targets and prioritize harness work.

Common Pitfalls

Skipping local check_build before PR submission.
Treating one sanitizer pass as complete validation.
Ignoring architecture-specific issues (some findings reproduce only on i386 or x86_64).

Notes

Best for continuous defect discovery, not one-off local triage.
For closed-source/internal projects, use ClusterFuzz/ClusterFuzzLite style alternatives.
Build artifacts copied to $OUT should remain reasonably small to avoid slow transfer/unzip cycles.

Resources

---name: oss-fuzzdescription: Auth/lab ref: Google-hosted continuous fuzzing service for open-source projects. For long-running, scalable fuzz campaigns, sanitizer-backed triage, and continuous bug reporting with reproducible local workflows.license: Apache-2.0---# oss-fuzzContinuous fuzzing platform that runs supported engines (`libFuzzer`, `AFL++`, `Honggfuzz`, `Centipede`) at scale.## When to Use- You maintain an open-source project and need persistent fuzz coverage.- You want automated sanitizer-based crash reporting and regression tracking.- You need multi-language support beyond ad-hoc local campaigns.## Core Flow1. Add project integration config to OSS-Fuzz repo.2. Define build/fuzz targets and seed corpora.3. Validate locally with OSS-Fuzz tooling.4. Submit and monitor issue stream.## Local Validation Flow```bashpython3 infra/helper.py build_image <project>python3 infra/helper.py build_fuzzers --sanitizer address <project>python3 infra/helper.py check_build <project>python3 infra/helper.py run_fuzzer --corpus-dir=<tmp-corpus> <project> <fuzz_target>```Run additional sanitizer/engine combinations when integration quality is uncertain.## Reproduction Flow (Bug Fix Loop)```bashpython3 infra/helper.py reproduce <project> <fuzz_target> <testcase_path>```If the bug is not reproducible immediately:- pull latest images,- match sanitizer and architecture from report,- retry with exact target binary and runtime flags.## Practical Tricks- Keep seed corpus and dictionaries small but meaningful; large noisy corpora can slow signal.- Prefer statically linked fuzz binaries in build scripts for runtime compatibility.- Use Fuzz Introspector reports to detect low-reach fuzz targets and prioritize harness work.## Common Pitfalls- Skipping local `check_build` before PR submission.- Treating one sanitizer pass as complete validation.- Ignoring architecture-specific issues (some findings reproduce only on `i386` or `x86_64`).## Notes- Best for continuous defect discovery, not one-off local triage.- For closed-source/internal projects, use ClusterFuzz/ClusterFuzzLite style alternatives.- Build artifacts copied to `$OUT` should remain reasonably small to avoid slow transfer/unzip cycles.## Resources- https://google.github.io/oss-fuzz/- https://github.com/google/oss-fuzz- https://google.github.io/oss-fuzz/getting-started/new-project-guide/- https://google.github.io/oss-fuzz/advanced-topics/reproducing/- https://google.github.io/clusterfuzzlite/

Frequently asked questions

Oss Fuzz