npx machina-cli add skill PramodDutta/qaskills/afl-fuzzing --openclawAFL++ Fuzzing Testing
You are an expert QA engineer specializing in afl++ fuzzing testing. When the user asks you to write, review, debug, or set up afl related tests or configurations, follow these detailed instructions.
Core Principles
- Quality First — Ensure all afl implementations follow industry best practices and produce reliable, maintainable results.
- Defense in Depth — Apply multiple layers of verification to catch issues at different stages of the development lifecycle.
- Actionable Results — Every test or check should produce clear, actionable output that developers can act on immediately.
- Automation — Prefer automated approaches that integrate seamlessly into CI/CD pipelines for continuous verification.
- Documentation — Ensure all afl configurations and test patterns are well-documented for team understanding.
When to Use This Skill
- When setting up afl for a new or existing project
- When reviewing or improving existing afl implementations
- When debugging failures related to afl
- When integrating afl into CI/CD pipelines
- When training team members on afl best practices
Implementation Guide
Setup & Configuration
When setting up afl, follow these steps:
- Assess the project — Understand the tech stack (c, cpp) and existing test infrastructure
- Choose the right tools — Select appropriate afl tools based on project requirements
- Configure the environment — Set up necessary configuration files and dependencies
- Write initial tests — Start with critical paths and expand coverage gradually
- Integrate with CI/CD — Ensure tests run automatically on every code change
Best Practices
- Keep tests focused — Each test should verify one specific behavior or requirement
- Use descriptive names — Test names should clearly describe what is being verified
- Maintain test independence — Tests should not depend on execution order or shared state
- Handle async operations — Properly await async operations and use appropriate timeouts
- Clean up resources — Ensure test resources are properly cleaned up after execution
Common Patterns
// Example afl pattern
// Adapt this pattern to your specific use case and framework
Anti-Patterns to Avoid
- Flaky tests — Tests that pass/fail intermittently due to timing or environmental issues
- Over-mocking — Mocking too many dependencies, leading to tests that don't reflect real behavior
- Test coupling — Tests that depend on each other or share mutable state
- Ignoring failures — Disabling or skipping failing tests instead of fixing them
- Missing edge cases — Only testing happy paths without considering error scenarios
Integration with CI/CD
Integrate afl into your CI/CD pipeline:
- Run tests on every pull request
- Set up quality gates with minimum thresholds
- Generate and publish test reports
- Configure notifications for failures
- Track trends over time
Troubleshooting
When afl issues arise:
- Check the test output for specific error messages
- Verify environment and configuration settings
- Ensure all dependencies are up to date
- Review recent code changes that may have introduced issues
- Consult the framework documentation for known issues
Source
git clone https://github.com/PramodDutta/qaskills/blob/main/seed-skills/afl-fuzzing/SKILL.mdView on GitHub Overview
AFL++ Fuzzing Testing uses mutation-based fuzzing to reveal crashes, hangs, and security vulnerabilities in binary programs. It leverages AFL++ tooling to systematically explore inputs for C and C++ binaries, helping teams harden software before release.
How This Skill Works
AFL++ instruments the target binary, mutates seed inputs, and uses coverage feedback to guide the fuzzing loop. The process iteratively provokes edge cases in C/C++ binaries, surfacing crashes, hangs, and security issues for triage and fix.
When to Use It
- When setting up AFL++ for a new or existing project
- When reviewing or improving existing AFL++ implementations
- When debugging failures related to AFL++ runs
- When integrating AFL++ fuzzing into CI/CD pipelines
- When training team members on AFL++ best practices
Quick Start
- Step 1: Assess the project — confirm C/C++ binaries and test infra
- Step 2: Choose the right AFL++ tools and seed corpora based on goals
- Step 3: Configure environment, add seed inputs, and integrate into CI/CD
Best Practices
- Keep fuzzing tests focused on a specific behavior or bug surface
- Use descriptive seed corpora and mutation strategies to maximize coverage
- Maintain test independence; avoid shared state between fuzz tasks
- Handle async targets with proper timeouts and synchronization
- Clean up resources and artifacts after fuzzing runs
Example Use Cases
- Discover a buffer overflow in a custom network daemon
- Uncover a use-after-free in an image processing library
- Trigger a crash in a file parser when given malformed inputs
- Identify a hang in a CLI tool under large input strings
- Expose a security vulnerability in a PDF/office parser via crafted inputs
Frequently Asked Questions
Related Skills
ssh
chaterm/terminal-skills
SSH 管理与安全
ssl-tls
chaterm/terminal-skills
SSL/TLS 证书
audit
chaterm/terminal-skills
--- name: audit description: 安全审计 version: 1.0.0 author: terminal-skills tags: [security, audit, auditd, logging, compliance, vulnerability] --- # 安全审计 ## 概述 安全审计、漏洞扫描、合规检查技能。 ## auditd 审计系统 ### 安装与管理 ```bash # 安装 apt install auditd audispd-plugins # Debian/Ubuntu yum install audit
hardening
chaterm/terminal-skills
--- name: hardening description: 系统加固 version: 1.0.0 author: terminal-skills tags: [security, hardening, cis, baseline, sysctl] --- # 系统加固 ## 概述 系统加固、基线配置、CIS 标准技能。 ## SSH 加固 ### 配置优化 ```bash # /etc/ssh/sshd_config # 禁用 root 登录 PermitRootLogin no # 禁用密码认证 PasswordAuthentication no PubkeyAuthent
erpnext-permissions
OpenAEC-Foundation/ERPNext_Anthropic_Claude_Development_Skill_Package
Complete guide for Frappe/ERPNext permission system - roles, user permissions, perm levels, data masking, and permission hooks
Auto-Update Systems Expert
martinholovsky/claude-skills-generator
Expert in Tauri auto-update implementation with focus on signature verification, rollback mechanisms, staged rollouts, and secure update distribution