菜单
List all unique triaged crashes for a fuzz target from its INDEX.md. Use when the operator asks "what crashes do we have", "list crashes for <target>", or invokes $fuzz-crashes <target>. Equivalent of /fuzz-crashes in Claude Code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when reviewing, triaging, or classifying AFL++ crashes in ~/fuzzing/targets/*/crashes-triaged/. Triggers on "review crashes", "triage crashes", "look at the crashes", "what bugs did we find", "classify crashes", "which crashes matter". Reads INDEX.md + trace.txt per hash, classifies by bug type and severity, inspects source at the top frame, and outputs a prioritized action table.
Launch the fuhq browser dashboard for live fuzz state, per-target views, and per-crash drill-down. Use when the operator asks for the dashboard, browser UI, fuhq, or invokes $fuzz-dashboard. Equivalent of /fuzz-dashboard in Claude Code.
Show fuzz rig status for a single target — live fuzzer count, execs/sec, coverage, crashes, disk. Use when the operator asks for the status of a specific target or invokes $fuzz-status <target>. Equivalent of /fuzz-status in Claude Code. For a multi-target summary, use $check-in instead.
Use when standing up a new AFL++ fuzz target. Triggers on "add new target", "set up fuzzing for X", "fuzz <name>", "new fuzz target", "start fuzzing <library>". Walks the full pipeline (seeds → 3 builds → cmin → triage → systemd) adapted to the target's build system (cmake / autoconf / meson / custom). Uses the fuzzah kit's `target-template/` as the starting point.
Deep-dive a specific crash by hash. Loads meta.json + trace.txt and applies the fuzz-crash-review per-crash workflow (classify by signal class, inspect top-frame source, recommend action). Use when the operator asks to review, triage, or explain a specific crash hash, or invokes $fuzz-review <hash> <target>. Equivalent of /fuzz-review in Claude Code.
Cross-target fuzz dashboard. Prints live fuzzer counts, execs/sec, unique crash counts, and a breakdown of crashes by workflow state (new → reviewed → repro-ok → reported). Use when the operator asks for a health snapshot, wants to know where to focus today, or invokes $check-in. Equivalent of /check-in in Claude Code.
| name | fuzz-crashes |
| description | List all unique triaged crashes for a fuzz target from its INDEX.md. Use when the operator asks "what crashes do we have", "list crashes for <target>", or invokes $fuzz-crashes <target>. Equivalent of /fuzz-crashes in Claude Code. |
Dump the crash roster for the target.
target="${TARGET:?target name required}"
bash "$(git rev-parse --show-toplevel 2>/dev/null || echo .)/shared/fuzz-crashes.sh" "$target"
After the table, also report:
first_seen timestampno-frames or no-asan-report top_frame (worth re-examining with a manual gdb run)memlimit-kill top_frame (auto-ignored artifacts)