qa-fuzz-testing
Structure-aware coverage-guided fuzzing: 3 reference skills (corpus-management-reference, sanitiser-integration-reference, crash-triage-reference) + 7 per-language fuzzer skills (libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration) + 1 dispatcher skill (fuzz-tool-selector) + 2 agents (fuzz-target-author, fuzz-findings-critic). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.
Install this plugin
/plugin install qa-fuzz-testing@testland-qaPart of role bundle: qa-role-security
qa-fuzz-testing
Structure-aware coverage-guided fuzzing: the coverage-guided-fuzzing umbrella skill (fuzzer choice + engine-generic workflow, with libFuzzer, AFL++, cargo-fuzz, Go native, Atheris, Jazzer, corpus-management, and sanitizer-integration as references) + crash-triage-reference (per-crash reading and the bulk BLOCK/PASS triage workflow) + 1 agent (fuzz-target-author). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.
Components
| Type | Name | Description |
|---|---|---|
| skill | coverage-guided-fuzzing | Fuzzer-choice routing tree + engine-generic workflow (target, corpus, sanitizers, CI); per-engine depth (libFuzzer, AFL++, cargo-fuzz, Go native, Atheris, Jazzer) plus corpus-management and sanitizer-integration catalogs as references |
| Skill | crash-triage-reference | Triaging fuzzer crashes: ASan/UBSan/MSan reading, exploitability classification, stack-hash dedup, minimization, and the bulk triage workflow ending in a BLOCK/PASS verdict |
| agent | fuzz-target-author | Scaffold a fuzz target from a function signature (routed via the umbrella's routing tree) |
Differentiation
This plugin scopes structure-aware coverage-guided fuzzing at the binary / system level. Sibling neighbours:
Install
/plugin marketplace add testland/qa
/plugin install qa-fuzz-testing@testland-qaSkills
coverage-guided-fuzzing
Coverage-guided fuzzing across every mainstream engine - libFuzzer (C/C++ in-process), AFL++ (out-of-process, QEMU mode for closed-source binaries), cargo-fuzz (Rust), Go native fuzzing (go test -fuzz), Atheris (Python), and Jazzer (JVM, @FuzzTest). Body covers choosing the right fuzzer for the language and build type (the routing tree) plus the engine-generic workflow: writing a small deterministic fuzz target, seed-corpus + dictionary construction, sanitizer selection (ASan + UBSan default, compatibility matrix), corpus minimisation, crash-artifact handling, and CI smoke-fuzz wiring with a cached corpus. Per-engine depth (flags, harness syntax, CI jobs) lives in references, as do the corpus-management and sanitizer-integration catalogs. Use when a project needs fuzz coverage and no fuzzer is chosen yet, or when authoring / running / maintaining a fuzz campaign with any of these engines. For triaging the resulting crashes see crash-triage-reference.
crash-triage-reference
Reference catalog for triaging fuzzer crash artifacts - reading ASan, UBSan, and MSan output; classifying findings as LIKELY-EXPLOITABLE, MEDIUM, or BENIGN; deduplicating by stack-hash; minimizing reproducers with -minimize_crash; plus the bulk triage workflow for a full artifact directory (inventory, reproduce, classify, dedupe, BLOCK/PASS verdict with refuse-to-proceed rules and a report template). Use when you need to understand what a specific crash means, build exploitability intuition, work a set of findings by hand, or run a campaign-level triage that ends in a release verdict.