# Vibe Fuzz Parser Inputs

> Generates fuzz test scaffolding for parsers handling external input (YAML, JSON, config files, user input). Seeds corpus from existing fixtures and runs initial pass.

- **Type:** Skill
- **Install:** `agentstack add skill-ash1794-vibe-engineering-fuzz-parser-inputs`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ash1794](https://agentstack.voostack.com/s/ash1794)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ash1794](https://github.com/ash1794)
- **Source:** https://github.com/ash1794/vibe-engineering/tree/master/plugins/vibe-engineering/skills/fuzz-parser-inputs

## Install

```sh
agentstack add skill-ash1794-vibe-engineering-fuzz-parser-inputs
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# vibe-fuzz-parser-inputs

Every parser will eventually see input you didn't expect. Fuzz testing finds the crashes before production does.

## When to Use This Skill

- Implementing any parser (YAML, JSON, XML, config, DSL)
- Processing user-supplied input
- Handling webhook payloads or API responses
- Parsing file formats

## When NOT to Use This Skill

- The parser is a well-tested standard library (e.g., `encoding/json`)
- You're only reading known, controlled input
- The parser is trivial (e.g., splitting a string by comma)

## Steps

### Go Fuzz Tests

1. **Create fuzz test file** (`parser_fuzz_test.go`):
   ```go
   func FuzzParseConfig(f *testing.F) {
       // Seed corpus from existing test fixtures
       files, _ := filepath.Glob("testdata/*.yaml")
       for _, file := range files {
           data, _ := os.ReadFile(file)
           f.Add(data)
       }

       // Add targeted seeds
       f.Add([]byte(""))           // empty
       f.Add([]byte("{}"))         // minimal valid
       f.Add([]byte("\x00\x00"))   // binary

       f.Fuzz(func(t *testing.T, data []byte) {
           // Should never panic
           result, err := ParseConfig(data)
           if err != nil {
               return // errors are fine
           }
           // If no error, result should be valid
           if result.Name == "" {
               t.Error("parsed successfully but Name is empty")
           }
       })
   }
   ```

2. **Seed the corpus** from:
   - Existing test fixtures
   - Real production examples
   - Known edge cases
   - Minimally valid inputs
   - Binary/garbage data

3. **Run initial fuzz**:
   ```bash
   go test -fuzz=FuzzParseConfig -fuzztime=30s
   ```

4. **Record results**:
   - Crashes found
   - New corpus entries generated
   - Edge cases discovered

5. **Fix crashes** -- Every panic or unexpected behavior becomes a permanent test case

### Other Languages

- **JavaScript/TypeScript**: Use `jest-fuzz` or `fast-check` property-based testing
- **Python**: Use `hypothesis` for property-based testing
- **Rust**: Use `cargo-fuzz` with `libfuzzer`

## Output Format

### Fuzz Test: [Parser Name]

**Seeds**: X (Y from fixtures, Z manual)
**Duration**: [fuzz time]
**Corpus growth**: X -> Y entries (Z% expansion)
**Crashes found**: N

| # | Input (hex) | Crash Type | Fix |
|---|-------------|-----------|-----|
| 1 | `\x00\xff...` | nil panic in tokenizer | Added nil check at line 42 |

### New Edge Cases Discovered
1. [Description] -- added as permanent test case

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ash1794](https://github.com/ash1794)
- **Source:** [ash1794/vibe-engineering](https://github.com/ash1794/vibe-engineering)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-ash1794-vibe-engineering-fuzz-parser-inputs
- Seller: https://agentstack.voostack.com/s/ash1794
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.