| name | xo-fuzz |
| description | Use this skill when the user asks to fuzz, stress-test, property-test, or find crashes in existing code. Runs fast-check property-based fuzzing on module exports. This mode is deterministic — no subagents or API required. Distinguishes AdapterErrors (expected rejections) from real bugs (TypeError/RangeError/etc). Writes crash corpus for CI replay. |
| allowed-tools | Bash, Read |
XOLoop — Fuzz Mode (deterministic, no LLM)
Property-based fuzzing via fast-check. This mode does not use LLM
calls at all — it's pure property testing that generates adversarial
inputs and distinguishes expected rejections (AdapterError with
err.code) from real bugs (TypeError, RangeError, unhandled
promise rejection, etc).
No API key required, no subagents spawned — the fuzz engine is fully
deterministic given a seed.
When to invoke
- "fuzz this"
- "stress test X"
- "property-test Y"
- "find edge cases in Z"
- "what inputs crash this?"
- "throw random data at this and see what breaks"
Verify / Discovery use
Fuzz is read-only, but it should feed Verify before risky refactor or
optimization work. Run xoloop-verify discover --write --json, select
repo-specific suites from detected frontend, api, state, function, runtime-lab, performance,
formal, cli, concurrency, state-machine, and safety surfaces, then add
crash corpus or property cases to the matching goal. Treat
PASS_EVIDENCED as usable evidence; keep PASS_WITH_GAPS visible and
require accepted named gaps before downstream mutation.
How to invoke
node $CLAUDE_PLUGIN_ROOT/bin/xoloop-fuzz.cjs \
--module <path> \
[--runs 1000] \
[--seed <int>]
Defaults
--runs 1000 (fast-check default; increase to 10000 for deeper runs)--seed auto-generated; recorded in output for repro
What fuzz does NOT do
- Not for writing unit tests → route to
xo-build
- Not for finding logic bugs → route to
xo-audit
- Not for performance → route to
xo-improve
Output
- Crash corpus entries in
.xoloop/corpus/<module>/<hash>.json
(inputs + stack)
- CI can replay via
--replay-corpus flag
- Summary: total runs, shrunk crashes, replay coverage
Safety
- Read-only — fuzz never modifies code
- No LLM calls, no network, no API key
- No filesystem writes outside
.xoloop/corpus/
