cargo-fuzz

Fuzz Rust crates with cargo-fuzz and libFuzzer to uncover crashes.

9|4|Updated Feb 7, 2026
One-click install
npx skills add https://github.com/marduk191/qwen3_mcp --skill cargo-fuzz-marduk191
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cargo-fuzz
Source: https://github.com/marduk191/qwen3_mcp/tree/main/skills/testing-handbook-skills/skills/cargo-fuzz
Command: npx skills add https://github.com/marduk191/qwen3_mcp --skill cargo-fuzz-marduk191

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fuzz Rust projects with the cargo-fuzz backend to uncover crashes, undefined behavior, and security issues in crates built with Cargo and libFuzzer.

Core Features & Use Cases

  • Integrates the libFuzzer backend with a convenient cargo subcommand that automatically enables relevant compilation flags.
  • Supports sanitizer integration (e.g., AddressSanitizer) for safer, faster tests and clearer crash reports.
  • Provides straightforward setup and guidance for harness creation, target configuration, and running fuzz campaigns.

Quick Start

Initialize fuzzing with cargo fuzz init, then edit fuzz/fuzz_targets/fuzz_target_1.rs and run cargo +nightly fuzz run fuzz_target_1.

Frequently Asked Questions about cargo-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fuzz a Rust crate to find crashes and undefined behavior?

Fuzz a Rust crate by initializing a fuzzing harness with cargo fuzz init, editing the generated fuzz target, and running the campaign with cargo +nightly fuzz run to uncover crashes and undefined behavior.

Do I need a nightly Rust toolchain to run cargo-fuzz?

Yes, cargo-fuzz requires a nightly Rust toolchain to enable the necessary compilation flags for libFuzzer integration and structure-aware fuzzing of library and binary crates.

Can I use AddressSanitizer with cargo-fuzz for Rust projects?

Yes, cargo-fuzz supports sanitizer integration including AddressSanitizer, providing clearer crash reports and safer testing when fuzzing Rust crates built with Cargo and libFuzzer.

What is the best way to set up structure-aware fuzzing for a Rust library?

Structure-aware fuzzing is set up by running cargo fuzz init to generate a fuzz directory, configuring your fuzz target harness in the fuzz_targets folder, and executing with cargo +nightly fuzz run.

Does cargo-fuzz work with binary crates or only library crates in Rust?

cargo-fuzz targets both library and binary crates in Rust, enabling libFuzzer-backed fuzz campaigns to detect security issues and undefined behavior across different crate types.

Why does cargo-fuzz require libFuzzer for fuzzing Rust projects?

cargo-fuzz requires libFuzzer because it serves as the backend that integrates with the cargo subcommand, automatically enabling compilation flags needed for structure-aware fuzzing and crash detection.