skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

ossfuzz

Configures continuous fuzzing infrastructure and enrolls projects into OSS-Fuzz.

Updated Apr 5, 2026
Search Tags:#Docker#security testing#sanitizers#fuzzing#oss-fuzz#libFuzzer#continuous fuzzing
One-click install
npx skills add https://github.com/marumo333/atrox --skill ossfuzz-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ossfuzz
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/testing-handbook-skills/skills/ossfuzz
Command: npx skills add https://github.com/marumo333/atrox --skill ossfuzz-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Setting up continuous fuzzing infrastructure for open-source projects requires managing Docker images, sanitizer builds, corpus handling, and coverage reporting, which is complex to configure manually. ## Core Features & Use Cases - Local Harness Execution: Build project images, compile fuzzers with sanitizers, and run individual harnesses using the helper.py CLI without hosting the full platform. - Project Enrollment: Create the required project.yaml, Dockerfile, and build.sh files to enroll C/C++, Python, or Rust projects into OSS-Fuzz or a private instance. - Coverage and Bug Analysis: Generate local coverage reports, monitor build statuses, and use Fuzz Introspector to identify fuzzing blockers. - Use Case: You maintain a C++ library and want continuous fuzzing. Use this Skill to write the three enrollment files, test harnesses locally with AddressSanitizer, and submit the project for OSS-Fuzz acceptance. ## Quick Start Help me enroll my open-source C++ project into OSS-Fuzz by creating the project.yaml, Dockerfile, and build.sh files and testing the harness locally.

Frequently Asked Questions about ossfuzz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an OSS-Fuzz harness locally?▼

Clone the google/oss-fuzz repository, then use infra/helper.py to build the project image, compile fuzzers with a sanitizer like address, and run the harness with run_fuzzer. The helper script automatically completes any skipped prerequisite steps.

How to enroll a new project into OSS-Fuzz?▼

Create three files under projects/<your-project>/: a project.yaml with metadata and sanitizers, a Dockerfile based on base-builder that clones your repo, and a build.sh that compiles harnesses using $LIB_FUZZING_ENGINE. Test locally with helper.py before submitting a pull request.

Does OSS-Fuzz support Rust and Python projects?▼

Yes, OSS-Fuzz supports Rust via cargo-fuzz with AddressSanitizer only, and Python via Atheris using the compile_python_fuzzer helper. Each language has specific project.yaml settings and build.sh conventions documented in the new project guide.

Can closed-source projects use OSS-Fuzz?▼

Public OSS-Fuzz only accepts select open-source projects meeting a criticality score threshold. However, the platform core is open-source, so you can host a private OSS-Fuzz instance for closed-source or lower-score projects.

Why does my OSS-Fuzz build fail with missing dependencies?▼

Build failures usually mean dependencies are not installed in the project Dockerfile. Add the required apt-get install commands or language-specific packages to the Dockerfile rather than build.sh, and verify the WORKDIR points to your source code.

Related Skills

Explore More Software Engineering Skills→
TECH-HYTECH-HY

ossfuzz

Set up continuous fuzzing infrastructure and enroll projects in OSS-Fuzz.

Official
Intermediate
rohanbhatia27rohanbhatia27
1

coverage-analysis

Evaluate and report code coverage achieved during fuzzing exercises.

Community
Intermediate
microsoftmicrosoft
1.4k

architecture-diagrams

Generate ASCII or Mermaid architecture diagrams from infrastructure files and DS_CATALOG_V1 data catalogs.

Official
Advanced
taracodlabstaracodlabs
779

docker-management

Automate Docker container, image, volume, and network management via CLI and Dockerode.

Official
Intermediate