New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Offensive Fuzzing

by SnailSploit in SnailSploit/Claude-Red

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies…

MITAuto-check: warningsSecurity

Install Offensive Fuzzing

The automated check flagged lines worth reading first. See the safety section below.

skills CLI
$ npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install SnailSploit/Claude-Red offensive-fuzzing --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/SnailSploit/Claude-Red.git skills-src && mkdir -p .claude/skills && cp -r skills-src/Skills/fuzzing/offensive-fuzzing .claude/skills/offensive-fuzzing && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
offensive-fuzzing
GitHub stars
7.3k
Token cost
~3k tokens
SKILL.md length
639 words
Files
1
Skills in repo
10
Repo updated
First seen
Licence
MIT

At a glance

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies…

  • Works in 7 steps: Research Target → Instrument and Build → Write Harness → …
  • Running fuzz campaigns against any target: file parsers
  • SKILL.md covers Fuzzer Types, Core Workflow, Oracle Selection and Specialized Targets, plus 3 more sections
  • Calls cargo, cmake and make

What it does

Offensive Fuzzing is an agent skill from SnailSploit/Claude-Red. Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.

Its SKILL.md is about 3k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Fuzzing. The repository describes itself as: claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level… The licence is MIT.

When your agent uses it

  • Running fuzz campaigns against any target: file parsers
  • Network protocols
  • Embedded firmware
  • Language runtimes

Example prompts

  • “/offensive-fuzzing”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Research Target
  2. Instrument and Build
  3. Write Harness
  4. Build Seed Corpus
  5. Launch Fuzzing
  6. Monitor and Unstick
  7. Triage Crashes

What it can do on your machine

Read from SKILL.md and the folder at commit 739512a. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • cargo
    • cmake
    • make
    • go

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • github.com
    • llvm.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Offensive Fuzzing loads about 3k tokens when it runs. Until then it costs about 105 tokens; SKILL.md has 639 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~105
When it runs · the whole SKILL.md, loaded when a task matches
~3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: warnings

The automated check found patterns that need a careful read before installing.

  • WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:189
    "sshkey": "/path/to/id_rsa",

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from SnailSploit/Claude-Red at commit 739512a, republished under its MIT licence (© SnailSploit). 639 words, ~2,963 tokens.

Download SKILL.mdSave it as .claude/skills/offensive-fuzzing/SKILL.md (or your agent's skills folder).
name
offensive-fuzzing
description
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.

Offensive Fuzzing

Fuzzer Types

TypeCoverageSpeedTools
BlackBoxPoorFastPeach, Boofuzz
GreyBoxGoodFastAFL++, Honggfuzz, libFuzzer, WinAFL
SnapshotGoodFastestNyx, wtf, Snapchange
WhiteBoxBestSlowKLEE, QSYM, SymSan
EnsembleBestFastAFL++ + Honggfuzz + libFuzzer

GreyBox sub-variants: Directed (AFLGo, UAFuzz), Grammar (AFLSmart, Tlspuffin), Concolic (QSYM, Driller), Kernel (syzkaller, kAFL, wtf).

Core Workflow

Research target → Choose analyses → Build harness → Seed corpus → Instrument → Fuzz → Triage crashes → Report
1. Research Target
  • Map all input surfaces (files, network, IPC, syscalls, IOCTL)
  • Identify high-value areas: previously patched code, complex parsers, newly added code, input ingestion points
  • For kernel modules: look beyond copy_from_user — DMA-BUF ops, page fault handlers, VM operation structs, allocation callbacks
2. Instrument and Build
bash
# AFL++ (preferred for GreyBox)
CC=afl-clang-fast CXX=afl-clang-fast++ cmake -DCMAKE_BUILD_TYPE=Release .. && make -j

# libFuzzer + ASan/UBSan (C/C++)
cmake -DCMAKE_CXX_FLAGS="-fsanitize=fuzzer,address,undefined -O1 -g" ..

# CmpLog build for hard compares
AFL_LLVM_CMPLOG=1 CC=afl-clang-fast CXX=afl-clang-fast++ make clean all

Windows (MSVC): Project Properties → C/C++ → Address Sanitizer: Yes (/fsanitize=address)

3. Write Harness

libFuzzer (C++):

cpp
#include <cstdint>
#include <cstddef>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
    parse_or_process(data, size);
    return 0;
}

Honggfuzz HF_ITER (persistent mode — preferred for large targets):

cpp
#include "honggfuzz.h"
int main(int argc, char** argv) {
    initialize_target(); // runs once
    for (;;) {
        size_t len; uint8_t *buf;
        HF_ITER(&buf, &len);
        FILE* s = fmemopen(buf, len, "r");
        target_function(s);
        fclose(s);
        reset_target_state();
    }
}

AFL++ persistent mode (__AFL_LOOP):

cpp
while (__AFL_LOOP(10000)) {
    // re-read input and process
}

macOS IPC (Mach message fuzzing):

c
void *lib_handle = dlopen("libexample.dylib", RTLD_LAZY);
pFunction = dlsym(lib_handle, "DesiredFunction");
4. Build Seed Corpus
  • Pull from target's test suite, bug reports, and real-world samples
  • Web-crawl (Common Crawl) for file formats; filter by MIME type
  • Minimize: afl-cmin -i raw_corpus -o seeds -- ./target @@
  • Trim inputs: afl-tmin -i crash -o crash.min -- ./target @@
5. Launch Fuzzing

AFL++ parallel (primary + secondary with cmplog):

bash
afl-fuzz -M f1 -i seeds -o findings -x dict.txt -- ./target @@
afl-fuzz -S s1 -i seeds -o findings -c 0 -- ./target @@

libFuzzer:

bash
./target_libfuzzer corpus/ -max_total_time=3600 -workers=4

Binary-only (QEMU):

bash
afl-fuzz -Q -i seeds -o findings -- target.exe @@

Snapshot (AFL++ Nyx):

bash
NYX_MODE=1 AFL_MAP_SIZE=1048576 afl-fuzz -i seeds -o findings -- ./target_nyx @@

Ensemble (AFL++ + Honggfuzz sharing corpus):

bash
# Terminal 1
afl-fuzz -M fuzzer1 -i seeds -o sync_dir -- ./target @@
# Terminal 2
../honggfuzz/honggfuzz -i sync_dir/fuzzer1/queue -W sync_dir/hfuzz \
  --linux_perf_ipt_block -t 10 -- ./target ___FILE___
6. Monitor and Unstick

If progress stalls:

  • Enable CmpLog: -c 0 on AFL++ secondaries
  • Add dictionary: -x dict.txt or AFL_TOKEN_FILE
  • Switch to directed fuzzing (AFLGo) targeting specific BBs/functions
  • Use concolic assistance (QSYM, Driller) on hard branches
  • Snapshot the target to increase exec/s
  • AFL_MAP_SIZE=1048576, -L 0 for MOpt scheduler
7. Triage Crashes
bash
# 1. Minimize
afl-tmin -i crash -o crash.min -- ./target @@
# 2. Symbolize
ASAN_OPTIONS=abort_on_error=1:symbolize=1 ./target crash.min 2>asan.log
# 3. Hash + bucket
./cov-tool --bbids ./target crash.min > cov.hash
./bucket.py --key "$(cat cov.hash)" --log asan.log --out triage/

Sanitizer env quick reference:

ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_stack_use_after_return=1
UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1
TSAN_OPTIONS=halt_on_error=1:history_size=7
MSAN_OPTIONS=poison_in_dtor=1:track_origins=2

Oracle Selection

Bug ClassOracle
Memory safetyASan, HWASan (AArch64, lower overhead)
Uninitialized readsMSan
ConcurrencyTSan
Undefined behaviorUBSan
Type safetyTypeSan
Heap hardeningScudo Hardened Allocator
Logic bugsDifferential / idempotency oracles
Kernel memoryKASAN, KMSAN, KCSAN
Kernel UBKUBSan (CONFIG_UBSAN_TRAP=y)
CFIKCFI (-fsanitize=kcfi, Clang 18)
Binary-onlyQASAN (QEMU+ASan), DynamoRIO

Property oracle patterns:

  • Idempotency: f(x) == f(f(x))
  • Differential: compare two impls, bucket on output mismatch
  • Invariants: monotonic lengths, checksum equality, schema validation post-parse

Specialized Targets

Kernel (Linux) — syzkaller
json
{
  "target": "linux/arm64",
  "http": ":56700",
  "workdir": "/path/to/workdir",
  "kernel_obj": "/path/to/kernel",
  "image": "/path/to/rootfs.ext3",
  "sshkey": "/path/to/id_rsa",
  "procs": 8,
  "enable_syscalls": ["openat$module_name", "ioctl$IOCTL_CMD", "mmap"],
  "type": "qemu",
  "vm": { "count": 4, "cpu": 2, "mem": 2048 }
}
  • Limit enable_syscalls to deepen coverage on specific subsystems
  • Use syz-extract to pull constants for custom modules
  • Enable CONFIG_KASAN=y, CONFIG_KCFI=y, CONFIG_DEBUG_INFO_BTF=y
  • Use kcov filters and syz_cover_filter to direct coverage
  • Network fuzzing: inject via TUN/TAP + pseudo-syscalls (syz_emit_ethernet)
  • Crash decode: ./scripts/decode_stacktrace.sh vmlinux ... < dmesg.log

syzkaller repro:

bash
syz-execprog -repeat=0 -procs=1 -cover=0 -debug target.repro
Show full SKILL.md (273 more words)Show less
EDR / Windows Scanning Engines

WTF snapshot harness skeleton (mpengine.dll / mini-filter):

cpp
g_Backend->SetBreakpoint("nt!KeBugCheck2", [](Backend_t *Backend) {
    const uint64_t BCode = Backend->GetArg(0);
    Backend->Stop(Crash_t(fmt::format("crash-{:#x}", BCode)));
});

FilterConnectionPort fuzzing:

cpp
HANDLE hPort;
FilterConnectCommunicationPort(L"\\PortName", 0, NULL, 0, NULL, &hPort);
FilterSendMessage(hPort, fuzzData, sizeof(fuzzData), NULL, 0, &bytesReturned);

IOCTL fuzzing pattern:

cpp
HANDLE hDev = CreateFile(L"\\\\.\\DeviceName", GENERIC_READ|GENERIC_WRITE, ...);
DeviceIoControl(hDev, ioctlCode, inputBuf, inputLen, outBuf, outLen, &ret, NULL);
  • Take snapshots after initialization, right before parse/dispatch loop
  • Use IDA Lighthouse for coverage visualization
  • Monitor: DRIVER_VERIFIER_DETECTED_VIOLATION (0xc4), IRQL_NOT_LESS_OR_EQUAL (0xa)
  • WinDbg: .symfix; !analyze -v; k; !heap -p -a @rax

Cross-platform mpengine.dll on Linux (loadlibrary + HF_ITER + Intel PT):

cpp
// Bypass Lua VM to avoid stability issues
insert_function_redirect((void*)luaV_execute_address, my_lua_exec, HOOK_REPLACE_FUNCTION);
for (;;) {
    HF_ITER(&buf, &len);
    ScanDescriptor.UserPtr = fmemopen(buf, len, "r");
    __rsignal(&KernelHandle, RSIG_SCAN_STREAMBUFFER, &ScanParams, sizeof ScanParams);
}
Rust
bash
# Full Rust fuzzing pipeline
cargo test                                         # 1. property tests
cargo +nightly miri test                           # 2. UB via interpreter
cargo +nightly careful test                        # 3. runtime bounds checks
cargo fuzz run fuzz_target_1 -- -max_total_time=3600  # 4. libFuzzer crashes
RUSTFLAGS="--cfg loom" cargo test --release        # 5. concurrency (if needed)
cargo fuzz coverage fuzz_target_1                  # 6. coverage report

Focus unsafe blocks on: Vec::from_raw_parts, unchecked indexing, transmute size mismatches, pointer arithmetic, FFI integer truncation.

Embedded / Binary-Only
  • LibAFL: Modular Rust framework; Unicorn engine, snapshot module, LBRFeedback (zero-instrumentation on Intel), SAND decoupled sanitization
  • Retrowrite / QASAN: Binary rewriting for coverage + ASan without source
  • Nautilus: Grammar-based fuzzing for structured formats
Language Ecosystems
  • Go 1.18+: go test -fuzz=Fuzz -run=^$ ./...
  • Python: Atheris (CPython native extension fuzzing)
  • Rust: cargo-fuzz or honggfuzz-rs
  • JS engines: Fuzzilli with extended instrumentation (__builtin_return_address(0) for PC tracking)
  • Wasm runtimes: wasmtime-fuzz, wafl for differential fuzzing across V8/Wasmer/Wasmtime
  • Smart contracts: Echidna, Foundry-fuzz (Solidity); Move-Fuzz (Aptos/Sui)

CI/CD Integration

yaml
- name: Build with afl-clang-fast
  run: CC=afl-clang-fast make -j
- name: Fuzz (smoke, 15 min)
  run: timeout 15m afl-fuzz -i seeds -o findings -- ./target @@ || true
- name: Upload crashes
  if: always()
  uses: actions/upload-artifact@v4
  with:
    path: findings/**/crashes/*

Use ClusterFuzzLite for persistent continuous fuzzing; cache corpora between runs.

Crash Analysis Quick Reference

Linux:

bash
ulimit -c unlimited && sysctl -w kernel.core_pattern=core.%e.%p
gdb -q ./target core.* -ex 'bt' -ex 'info reg' -ex q
addr2line -e ./target 0xDEADBEEF

Windows:

powershell
# Enable local dumps
New-Item 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps' -Force
# PageHeap
gflags /p /enable target.exe /full

Kernel KASAN/KMSAN:

bash
dmesg -T | egrep -i 'kasan|kmsan' -A 60
./scripts/decode_stacktrace.sh vmlinux /lib/modules/$(uname -r)/build < dmesg.log

Reproducibility: pin CPU governor, disable ASLR only where safe, fix RNG seeds, save input sequences in persistent mode, record binary hashes and sanitizer options with every crash.

Tool Index

ToolUse Case
AFL++General GreyBox, CmpLog, MOpt, Nyx
HonggfuzzIntel PT, crash detection, HF_ITER
libFuzzerIn-process, source available
syzkallerLinux/Windows kernel syscall fuzzing
wtfSnapshot fuzzing, Windows targets
NyxAFL++ snapshot mode (Intel PT)
SnapchangeAWS snapshot fuzzing
LibAFLCustom Rust fuzzing framework
AFLGoDirected fuzzing to target BB/function
kAFLKernel + OS fuzzing
JackalopeBinary coverage-guided (Windows/macOS)
cargo-fuzzRust libFuzzer integration
AtherisPython fuzzing
NautilusGrammar-based fuzzing
AFLTriageAutomated crash triage
afl-covCoverage analysis for AFL++
ClusterFuzzDistributed fuzzing infrastructure

© SnailSploit, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in Skills/fuzzing/offensive-fuzzing of SnailSploit/Claude-Red.

Open the folder on GitHubat commit 739512a

Compare with similar skills

Offensive Fuzzing next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Offensive Fuzzing compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Offensive Fuzzing this skillSnailSploit/Claude-Red7.3k—~3kAutomated safety check: WarnMIT
Fizzpashov/skills1.2k2 repos~11kAutomated safety check: PassMIT
Fizz Syncpashov/skills1.2k2 repos~3.9kAutomated safety check: PassMIT
Research FuzzerARA-Labs/Agent-Native-Research-Artifact690—~2.4kAutomated safety check: PassMIT
Vuln Researchtanweai/xianzhi-research185—~847Automated safety check: PassNone
Binary Reverse Engineering Audittihanyin/REx-skill105—~5.1kAutomated safety check: PassMIT

Similar skills

  • Fizz

    pashov/skills

    Generate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects.

    1.2k GitHub starsUsed in 2 repos~11k tokens
    SecurityAuto-check passed

  • Fizz Sync

    pashov/skills

    Reconcile an existing Fizz harness with a changed source tree.

    1.2k GitHub starsUsed in 2 repos~3.9k tokens
    SecurityAuto-check passed

  • Research Fuzzer

    ARA-Labs/Agent-Native-Research-Artifact

    Treat an open-ended investigation the way a fuzzer treats a program.

    690 GitHub stars~2.4k tokensUpdated today
    SecurityAuto-check passed

  • Vuln Research

    tanweai/xianzhi-research

    安全研究元思考方法论 - 从先知社区5600+篇安全文档中提炼的漏洞挖掘方法论框架. An agent skill from tanweai/xianzhi-research.

    185 GitHub stars~847 tokensUpdated 8 mo ago
    SecurityAuto-check passed

  • Binary Reverse Engineering Audit

    tihanyin/REx-skill

    Guides evidence-first reverse engineering of compiled programs to find and prove defects, from triage and decompilation to fuzzing, patch diffing and firmware.

    105 GitHub stars~5.1k tokensUpdated 14 days ago
    SecurityAuto-check passed

  • Adaptive Web Fuzzing

    Encod3d-Sec/TORCH

    Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

    329 GitHub starsUsed in 1 repo~1.3k tokens
    SecurityAuto-check passed

More from SnailSploit/Claude-Red

All 10 skills in this repo

  • Offensive Krack Fragattacks

    SnailSploit/Claude-Red

    KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants.

    7.3k GitHub stars~1.1k tokensUpdated 18 days ago
    Auto-check: notes

  • Offensive Lorawan Sub Ghz

    SnailSploit/Claude-Red

    LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz…

    7.3k GitHub stars~1.7k tokensUpdated 18 days ago
    Auto-check passed

  • Offensive Mobile

    SnailSploit/Claude-Red

    Mobile (Android + iOS) application penetration testing methodology.

    7.3k GitHub stars~3.5k tokensUpdated 18 days ago
    Auto-check passed

  • Offensive Wifi

    SnailSploit/Claude-Red

    Wireless / 802.11 attack methodology for red team engagements and wireless security assessments.

    7.3k GitHub stars~2.8k tokensUpdated 18 days ago
    Auto-check: notes

  • Offensive Wps

    SnailSploit/Claude-Red

    WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout…

    7.3k GitHub stars~1.5k tokensUpdated 18 days ago
    Auto-check: notes

  • Offensive Z Wave

    SnailSploit/Claude-Red

    Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection…

    7.3k GitHub stars~1.3k tokensUpdated 18 days ago
    Auto-check passed

Categories

Questions about Offensive Fuzzing

What does Offensive Fuzzing do?

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies…. Offensive Fuzzing is an agent skill from SnailSploit/Claude-Red. Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage.

When should I use Offensive Fuzzing?

Offensive Fuzzing fits situations like: running fuzz campaigns against any target: file parsers; network protocols; embedded firmware; language runtimes.

How do I install Offensive Fuzzing in Claude Code?

Run `npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a claude-code`. Or copy the skill folder (Skills/fuzzing/offensive-fuzzing in SnailSploit/Claude-Red) into .claude/skills/offensive-fuzzing in your project. Claude Code loads it when a task matches its description.

How do I install Offensive Fuzzing in Codex?

Run `npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a codex`. Or copy the skill folder (Skills/fuzzing/offensive-fuzzing in SnailSploit/Claude-Red) into .agents/skills/offensive-fuzzing in your project. Codex loads it when a task matches its description.

Can I use Offensive Fuzzing in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/offensive-fuzzing, .gemini/skills/offensive-fuzzing, .github/skills/offensive-fuzzing and .opencode/skills/offensive-fuzzing in your project.

What does Offensive Fuzzing need to run?

Going by SKILL.md and its folder, Offensive Fuzzing needs the command-line tools its instructions call (cargo, cmake, make and go). Our summary lists: Python 3.

Does Offensive Fuzzing access the network?

SKILL.md names 2 domains. As links in the text: github.com and llvm.org. This is read from the text; nothing was executed.

Is Offensive Fuzzing safe to install?

Our automated static check of SKILL.md flagged 1 warning(s): mentions a credentials file (ssh keys, cloud or package-manager tokens). Read the flagged lines before installing; the check is not a guarantee either way.

What licence does Offensive Fuzzing use?

Offensive Fuzzing is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Offensive Fuzzing use?

About 3k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Offensive Fuzzing?

Skills that share tags, products or a category with Offensive Fuzzing: Fizz (pashov/skills, 1.2k stars), Fizz Sync (pashov/skills, 1.2k stars), Research Fuzzer (ARA-Labs/Agent-Native-Research-Artifact, 690 stars) and Vuln Research (tanweai/xianzhi-research, 185 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Offensive Fuzzing?

SnailSploit (a GitHub user) maintains it in SnailSploit/Claude-Red, which has 7,321 GitHub stars. The repository holds 10 skills in this directory. The repository was last updated on September 19, 2026.

Source: SnailSploit/Claude-Red on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.