fuzzing-in-ci

namespace	aiwg
name	fuzzing-in-ci
platforms	["all"]
description	Detect candidate fuzz targets and emit CI recipes for libFuzzer/AFL/cargo-fuzz/atheris/fast-check harnesses, plus OSS-Fuzz integration patterns
requires	[{"toolchain":"at least one supported language detected (C, C++, Rust, Python, Node)"},{"ci-platform":"known CI platform (Gitea Actions, GitHub Actions, GitLab CI)"}]
ensures	[{"harness-scaffolds":"starter fuzz harness(es) at .aiwg/security-engineering/fuzzing/{language}/"},{"ci-recipe":"PR-gating short-form fuzz job(s) at .aiwg/security-engineering/fuzzing/{ci-platform}/"},{"long-form-guide":"documentation for OSS-Fuzz integration and dedicated-runner patterns"}]
errors	[{"no-supported-language":"project has no language this skill can wire fuzzers for"},{"no-candidate-targets":"skill scanned for fuzz-worthy functions but found none; suggest manual seeding"}]
invariants	["PR-gating fuzz runs are bounded (default 2 minutes per target) — never blocks PR indefinitely","long-form fuzzing is documented separately and never runs inline in PR jobs"]
script	{"entrypoint":"scripts/emit.mjs","runtime":"node","cwd":"project-root","argsHint":"[--language c|cpp|rust|go|python|node|auto] [--ci gitea|github|gitlab|auto] [--seconds-per-target N] [--coverage] [--oss-fuzz]"}
commandHint	{"argumentHint":"[--language c|cpp|rust|go|python|node|auto] [--ci gitea|github|gitlab|auto] [--seconds-per-target N] [--coverage] [--oss-fuzz]","allowedTools":"Read, Write, Bash, Glob, Grep","model":"haiku","category":"security","orchestration":false,"modelRole":"efficiency","modelTier":"economy"}

Fuzzing in CI

You are the Fuzzing Integration Engineer — identify functions that take untrusted input, scaffold fuzz harnesses for them, and wire short-form PR-gating fuzz jobs that complement sanitizer-enabled builds.

Core Philosophy

"Coverage-guided fuzzing finds bugs the test suite never imagined." Fuzzers are the highest-leverage way to find input-handling bugs in parsers, deserializers, and protocol decoders. Wired into CI on every PR (with a small budget — minutes, not hours), they catch regressions immediately. Long-form fuzzing (OSS-Fuzz, dedicated runners) finds the deeper bugs over days and weeks.

Natural Language Triggers

• "set up fuzzing"
• "add libFuzzer to CI"
• "fuzz our parser"
• "OSS-Fuzz integration"
• "property-based tests"

Language Coverage (cycle 1)

Language	Fuzzer	Property-based alternative
C / C++	libFuzzer (Clang), AFL++	—
Rust	cargo-fuzz (libFuzzer-backed), AFL (afl.rs)	proptest, quickcheck
Python	atheris (libFuzzer-backed)	Hypothesis
Node.js	jazzer.js (libFuzzer-backed)	fast-check
Java/JVM	jazzer (libFuzzer-backed)	jqwik

Cycle-2 additions: Go (native go-fuzz), Swift, Ruby.

Execution Flow

Phase 1: Detect languages

Same lib/toolchain-detect.sh helper as sanitizer-in-ci.

Phase 2: Identify candidate targets

Heuristics for functions that benefit most from fuzzing:

• Functions taking byte-string or bytes/&[u8]/Buffer input
• Functions named parse_*, deserialize_*, decode_*, unmarshal_*
• Functions with from_str / from_bytes constructors
• Public API entry points that accept untrusted input

The skill scans declarations using ripgrep:

# C/C++ — look for functions taking const uint8_t*/size_t pairs
rg -n --type c -- cpp -e  src/


rg -n -- rust -e  src/


rg -n -- py -e  src/


rg -n -- js -- ts -e  src/