cargo-fuzz

Fuzz Rust library code with libFuzzer through a Cargo subcommand.

Updated Apr 5, 2026
One-click install
npx skills add https://github.com/marumo333/atrox --skill cargo-fuzz-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cargo-fuzz
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/testing-handbook-skills/skills/cargo-fuzz
Command: npx skills add https://github.com/marumo333/atrox --skill cargo-fuzz-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Rust developers need a structured way to discover memory bugs, panics, and parser vulnerabilities in their code, but setting up libFuzzer manually with correct compilation flags and sanitizers is error-prone and time-consuming. ## Core Features & Use Cases - Cargo-Integrated Fuzzing: Initialize fuzz targets with cargo fuzz init and run campaigns with automatic sanitizer and compilation flag configuration. - Structure-Aware Fuzzing: Integrate with the arbitrary crate to generate typed structured inputs instead of raw byte slices. - Coverage Analysis: Generate HTML coverage reports from fuzz corpora using LLVM tools to identify gaps in harness effectiveness. - Use Case: You maintain a Rust crate that parses Ogg media files. Use this Skill to write a fuzz target, seed the corpus with sample files, run a fuzzing campaign with AddressSanitizer, and measure coverage to find parsing bugs before attackers do. ## Quick Start Initialize cargo-fuzz in my Rust project and write a fuzz target that feeds random bytes into my parser function, then run it with the nightly toolchain.

Frequently Asked Questions about cargo-fuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fuzz Rust code with cargo-fuzz?▼

Install cargo-fuzz and the nightly toolchain, run `cargo fuzz init` in your project, then write a harness in `fuzz/fuzz_targets/` using the `fuzz_target!` macro. Start fuzzing with `cargo +nightly fuzz run fuzz_target_1`.

cargo-fuzz vs AFL++ vs LibAFL for Rust fuzzing?▼

cargo-fuzz is the primary choice for Cargo-based Rust projects with quick setup and integrated sanitizers. AFL++ suits multi-core fuzzing or non-Cargo projects, while LibAFL targets custom fuzzer development and research use cases.

Why does cargo-fuzz require the nightly Rust toolchain?▼

cargo-fuzz uses compilation features only available in nightly Rust, including sanitizer support and coverage instrumentation. Install nightly with `rustup install nightly` and invoke commands with `cargo +nightly fuzz`.

Can I disable AddressSanitizer in cargo-fuzz for faster fuzzing?▼

Yes, pass `--sanitizer none` when your project contains no unsafe Rust code, giving roughly 2x performance improvement. Check for unsafe code first with the cargo-geiger tool before disabling sanitizers.

How do I generate coverage reports from cargo-fuzz runs?▼

Run `cargo +nightly fuzz coverage fuzz_target_1` after installing llvm-tools-preview, cargo-binutils, and rustfilt. Then use `cargo cov -- show` with the generated profdata file to produce an HTML report of line coverage.

Why does cargo-fuzz fail with 'cannot find binary' error?▼

cargo-fuzz requires your code structured as a library crate, not only a binary. Split your `main.rs` so the fuzzable logic lives in `src/lib.rs` with public functions the fuzz target can call.