generative-fuzzing

Tests parser robustness by flooding untrusted input boundaries with generated malformed and random inputs.

Updated Jun 24, 2026
One-click install
npx skills add https://github.com/Hakkadaikon/hymme --skill generative-fuzzing-hakkadaikon
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: generative-fuzzing
Source: https://github.com/Hakkadaikon/hymme/tree/main/skills/generative-fuzzing
Command: npx skills add https://github.com/Hakkadaikon/hymme --skill generative-fuzzing-hakkadaikon

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires fast-check, @jazzer.js.

What problem does it solve? Code that accepts untrusted input (parsers, deserializers, validators) often breaks on malformed, extreme, or random data, but writing expected outputs for every case is impractical. This Skill provides a structured method for fuzzing and coverage-guided fuzzing where the oracle is simply "does not crash, hang, or violate invariants." ## Core Features & Use Cases - Fuzzing procedure: Step-by-step workflow for selecting a single untrusted entry point, defining a breakage oracle (no crashes, no hangs, invariants hold), generating wide inputs, seeding a corpus, and setting termination criteria with fast-check in TypeScript. - Coverage-guided fuzzing: Instructions for instrumented fuzzers like @jazzer.js that grow a persistent corpus by rewarding new branch coverage, with separate short CI jobs and long nightly exploration runs. - Completion checklists: Concrete verification items such as invariant assertions, seed fixation for reproduction, crash minimization, and corpus persistence for regression. - Use Case: You have a parseConfig function that accepts arbitrary strings. Use this Skill to write a fast-check fuzz test asserting it never throws and always returns ok or error, then fix any minimized counterexample as a regression test. ## Quick Start Ask the AI to apply the generative-fuzzing skill to write a fuzz test for your parser function using fast-check with invariant checks and a fixed seed.

Frequently Asked Questions about generative-fuzzing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a fuzz test for a parser in TypeScript?

Use fast-check to generate wide inputs like arbitrary strings, call the parser, and assert it never throws and always returns a valid result shape. Fix the seed and numRuns so failures are reproducible and termination is explicit.

What is coverage-guided fuzzing and when should I use it?

Coverage-guided fuzzing measures code coverage at runtime and keeps inputs that open new branches as seeds for mutation. Use it for parsers with deep branching where plain random input cannot reach deep paths; shallow targets do not justify the instrumentation cost.

fast-check vs @jazzer.js for fuzzing JavaScript?

fast-check runs inside normal test runners like vitest and suits simple robustness checks with fixed run counts. @jazzer.js is a libFuzzer-based instrumented runner that grows a persistent corpus and reaches deeper branches, but needs a separate CI job.

Why does my fuzz test miss bugs that return wrong values?

Checking only that code does not crash lets silently wrong outputs slip through. Add invariant assertions on the result, such as the returned kind being ok or error, so each added invariant expands the class of bugs the fuzzer can detect.

When should I use property-based testing instead of fuzzing?

Use property-based testing when you need to verify the semantic correctness of outputs against a property, since fuzzing only checks that code does not break. Fuzzing fits robustness checks at untrusted input boundaries where no correct answer exists.