Best fuzzing skills for Claude Code, Codex and other agents.

Generate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects.

pashov/skills

Diagnoses a failed GreptimeDB fuzz CI job by pulling its GitHub Actions logs and fuzz artifacts, then matching the evidence to the local source code.

GreptimeTeam/greptimedb

Find latent bugs in a local PostgreSQL source tree (RELxxSTABLE branch or HEAD) the way a core hacker does: build a heavily-poisoned debug instance (cassert + cache-discard + -O0/-ggdb3 + core…

digoal/blog

Go testing patterns including table-driven tests, subtests, benchmarks, fuzzing, and test coverage.

antoniopaya22/go-rest-template

Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes.

pashov/skills

Reconcile an existing Fizz harness with a changed source tree.

pashov/skills

Treat an open-ended investigation the way a fuzzer treats a program.

ARA-Labs/Agent-Native-Research-Artifact

Repro-first QA for Inkline — minimal .ink.tsx reproductions, the visual-parity and cross-target harnesses, fuzz targets, and how to audit teammates' claims.

inkline/inkline

安全研究元思考方法论 - 从先知社区5600+篇安全文档中提炼的漏洞挖掘方法论框架. An agent skill from tanweai/xianzhi-research.

tanweai/xianzhi-research

Guides evidence-first reverse engineering of compiled programs to find and prove defects, from triage and decompilation to fuzzing, patch diffing and firmware.

tihanyin/REx-skill

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

Encod3d-Sec/TORCH

A skill your agent uses when you need to add or review fuzz testing for Java APIs with CATS — including contract-driven negative testing, malformed payload validation, boundary input exploration, CI…

jabrena/plinth

Reference vocabulary for designing instrumented harnesses that drive vulnerability discovery — design classes (trigger-driven vs coverage-driven), tiered scope (T1 isolated function / T2…

provos/ironcurtain

Run a fuzzing campaign using AFL++ with optional seeds; supports --custommutatorpath (you can write your own custom mutator and use this to execute).

opensage-agent/opensage-adk

Create Foundry fuzz tests from deterministic unit tests. An agent skill from aviggiano/security.

aviggiano/security

Research notes drawn from Trail of Bits, SlowMist, ConsenSys, Immunefi and Cyfrin on smart contract audit methodology, with Slither, Echidna and Medusa setup.

tradecatlabs/vibe-coding-cn

Adds a new Go fuzz target to remindb following its seed-corpus discipline: one target per logical surface, discovered automatically by its FuzzXxx function name.

radimsem/remindb

Build, test, or update the iccDEV ClusterFuzzLite libFuzzer integration across ASan, UBSan, and MSan.

InternationalColorConsortium/iccDEV

Add, run or schedule a fuzz target in this repository. An agent skill from s3s-project/s3s.

s3s-project/s3s

Design and interpret advanced content discovery with ffuf and complementary web fuzzers.

cyberful/cyberful

Build metric-driven Chimera/create-chimera-app stateful invariant testing campaigns for Solidity projects.

aviggiano/security

Production-ready Golang tests — table-driven tests, testify suites and mocks, parallel tests, fuzzing, fixtures, goroutine leak detection with goleak, snapshot testing, code coverage, integration…

unxed/f4

Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation.

aftermathlabs/llvm-msvc

Extract crash inputs from fuzzing output into a target directory.

opensage-agent/opensage-adk

Guides writing and improving fuzzing harnesses for C, C++ and Rust so random byte input gets translated into structured, reproducible test cases for the target code.

trailofbits/skills

Web2 recon pipeline — subdomain enum, URL crawling, JS analysis, temp emails, directory fuzzing.

Gabson0x/bountyforge

Runs ffuf for DAST work: directory and file discovery, GET and POST parameter fuzzing, virtual host enumeration and filtered, recursive scans.

AgentSecOps/SecOpsAgentKit

Triages survived mutants and unnecessary test statements using Trailmark call-graph data, sorting them into false positives, missing unit tests and fuzzing targets.

trailofbits/skills

Walks through adding a new file format to remindb's Go parser package: the parser file, the ParseBytes case, table tests and fuzz seeds.

radimsem/remindb

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis…

awarexone/Agentic-Bug-Hunter

Sets up cargo-fuzz for a Cargo-based Rust project: nightly toolchain, fuzz targets, structured inputs, sanitizers, coverage and reproducing crashes.

trailofbits/skills

Builds fuzzing dictionaries of keywords, magic bytes and tokens and wires them into libFuzzer, AFL++ or cargo-fuzz so fuzzers get past input validation.

trailofbits/skills

Patches checksums, hash checks, time-based seeds and other non-deterministic state out of fuzzing builds so the fuzzer reaches deeper code, with production behavior intact.

trailofbits/skills

Builds custom fuzzers with LibAFL, the modular Rust fuzzing library.

trailofbits/skills

Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally.

trailofbits/skills

Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language.

trailofbits/skills

Guides through Trail of Bits' 5-step secure development workflow.

trailofbits/skills

Generates Foundry invariant tests and Echidna property-based fuzz tests for Solidity contracts.

alt-research2/SolidityGuard

Writes, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants.

trailofbits/skills

Discover hidden directories, files, and endpoints on a web server

NeoTheCapt/RedteamAgent

Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.

trailofbits/skills

Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.

trailofbits/skills

Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.

trailofbits/skills

Table-driven testler, subtestler, benchmark'lar, fuzzing ve test coverage içeren Go test desenleri.

affaan-m/ECC

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies…

SnailSploit/Claude-Red

Production-ready Golang tests — table-driven, testify suites/mocks, parallel tests, fuzzing, fixtures, goleak leak detection, snapshots, coverage, integration tests.

context-labs/whip

Generates fuzz test scaffolding for parsers handling external input (YAML, JSON, config files, user input).

ash1794/vibe-engineering

Patrones de pruebas Go incluyendo pruebas basadas en tablas, subpruebas, benchmarks, fuzzing y cobertura de código.

affaan-m/ECC