Fuzzing APIs

What it does

When your agent uses it

• Performing specialized testing
• With phrases like fuzz the API
• Run fuzzing tests
• Discover edge cases

Example prompts

• “fuzz the API”
• “run fuzzing tests”
• “discover edge cases”
• “/fuzzing-apis”

Requirements

• Python 3
• A credential in TEST_TOKEN
• Compatibility (from SKILL.md): Designed for Claude Code
• Pre-approved tools (allowed-tools): Read, Write, Edit, Grep, Glob, Bash(test:fuzz-*)

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

1. 1Parse the API specification to identify all endpoints, methods, and input schemas
2. 2Configure the fuzzing strategy
3. 3Define fuzz input categories for each parameter type
4. 4Execute the fuzzing campaign
5. 5Analyze findings
6. 6For each finding, create a minimal reproducer (smallest input that triggers the issue).
7. 7Write regression tests for confirmed bugs to prevent reintroduction.

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Write
  • Edit
  • Grep
  • Glob
  • Bash(test:fuzz-*)

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 2 files in scripts/ (Python), which the agent can run.

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • schemathesis.readthedocs.io
  • github.com
  • fast-check.dev
  • hypothesis.readthedocs.io
  • owasp.org

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • TEST_TOKEN

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Designed for Claude Code

  From compatibility in the SKILL.md frontmatter.

Context cost

Fuzzing APIs loads about 1.6k tokens when it runs, and up to ~1.6k if it reads all its reference files. Until then it costs about 59 tokens; SKILL.md has 541 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~59

When it runs · the whole SKILL.md, loaded when a task matches

~1.6k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 541 words, ~1,611 tokens.

name

fuzzing-apis

description

Configure perform API fuzzing to discover edge cases, crashes, and security vulnerabilities. Use when performing specialized testing. Trigger with phrases like "fuzz the API", "run fuzzing tests", or "discover edge cases".

allowed-tools

Read, Write, Edit, Grep, Glob, Bash(test:fuzz-*)

compatibility

Designed for Claude Code

version

1.25.0

author

Jeremy Longshore <jeremy@intentsolutions.io>

license

MIT

tags

testing, api, security

# Basic schema-based fuzzing
schemathesis run http://localhost:3000/api/openapi.json \  # 3000: 3 seconds in ms
  --stateful=links \
  --hypothesis-max-examples=500 \  # HTTP 500 Internal Server Error
  --base-url=http://localhost:3000 \  # 3 seconds in ms
  --header "Authorization: Bearer $TEST_TOKEN"

# With specific checks
schemathesis run http://localhost:3000/api/openapi.json \  # 3 seconds in ms
  --checks all \
  --validate-schema=true

import fc from 'fast-check';
import request from 'supertest';
import { app } from '../src/app';

test('POST /api/users handles arbitrary input without crashing', async () => {
  await fc.assert(
    fc.asyncProperty(
      fc.record({
        name: fc.string(),
        email: fc.string(),
        age: fc.oneof(fc.integer(), fc.string(), fc.constant(null)),
      }),
      async (body) => {
        const res = await request(app).post('/api/users').send(body);
        expect(res.status).toBeLessThan(500); // No server errors  # HTTP 500 Internal Server Error
      }
    ),
    { numRuns: 200 }  # HTTP 200 OK
  );
});

[
  "' OR '1'='1",
  "<script>alert(1)</script>",
  "${7*7}",
  "{{7*7}}",
  "../../../etc/passwd",
  "\u0000",
  "A".repeat(100000)  # 100000 = configured value
]

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (scripts, references, assets) in skills/.curated/fuzzing-apis of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• assets/README.md
• assets/report_template.md
• references/README.md
• scripts/README.md
• scripts/generate_payloads.py

Open the folder on GitHubat commit cfae287