cargo-fuzz

An agent skill by trailofbits, from trailofbits/skills. Tags: cli, fuzzing, rust, testing.

What it does

Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses, Arbitrary-derived structured inputs, sanitizer options, cargo fuzz coverage, and reproducing a crash artifact. Use when fuzzing a Rust crate, writing a fuzz_target!, exercising unsafe blocks or FFI in Rust, or triaging a cargo fuzz crash.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill cargo-fuzz

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/cargo-fuzz ~/.claude/skills/cargo-fuzz

Safety box score

Grade B, low risk: 19 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation-only guide for fuzzing Rust crates with `cargo-fuzz`; it mainly runs Cargo commands, compiles and executes fuzz targets, and can write fuzzing artifacts inside the project tree. The main risks are the inherent execution of project code under fuzzing, optional network downloads for seed corpora, and local tool installation that changes the user’s Cargo environment.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the user to run `cargo +nightly fuzz run ...`, `cargo +nightly fuzz coverage ...`, and build a helper script, which compiles and executes fuzz targets from the target crate.
Network access	1 (low)	The only explicit external fetch is optional example corpus seeding with `curl -o fuzz/corpus/fuzz_target_1/320x240.ogg https://commons.wikimedia.org/...`; the rest is local.
Filesystem reach	1 (low)	It creates and writes within the project tree (`cargo fuzz init`, `fuzz/`, `fuzz/artifacts/`, `fuzz_html/`, `./generate_html`), but does not instruct edits outside the working directory.
Secrets & credentials	0 (none)	No commands read keychains, `.env` files, tokens, browser sessions, or other credential stores.
Privilege & persistence	1 (low)	It uses `cargo install cargo-fuzz`, `cargo install cargo-geiger`, `cargo install cargo-binutils`, and `cargo install rustfilt`, which modify the user's Cargo-installed tools but do not require sudo or system-wide service changes.
Instruction hijack surface	0 (none)	There is no prompt-injection content, hidden instruction, or request to ignore higher-level rules.
Irreversible actions	0 (none)	The skill fuzzes and analyzes locally; it does not publish, deploy, send messages, pay, or delete external resources.
Transparency	0 (none)	All shipped files are human-readable text or SVG; there are no binaries, obfuscated blobs, or runtime-downloaded installers in the skill itself.

Before installing

Confirm you are comfortable running fuzz targets from the crate under test with `cargo +nightly fuzz run`.
Check whether you want the optional network fetch for the Wikimedia seed corpus.
Review whether `cargo install ...` will modify your local Cargo bin directory and PATH.
Run it first in a throwaway checkout if you want to inspect the generated `fuzz/` files and helper script.

Rated 2026-10-21 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/cargo-fuzz/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
fuzzing-dictionary — Builds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects.
libfuzzer — Sets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang.
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.