# Fuzz Harness Gen

> >

- **Type:** Skill
- **Install:** `agentstack add skill-yue-zhou1-zkcrypto-audit-fuzz-harness-gen`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Yue-Zhou1](https://agentstack.voostack.com/s/yue-zhou1)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Yue-Zhou1](https://github.com/Yue-Zhou1)
- **Source:** https://github.com/Yue-Zhou1/zkcrypto-audit/tree/main/plugins/evidence-and-tooling/skills/fuzz-harness-gen

## Install

```sh
agentstack add skill-yue-zhou1-zkcrypto-audit-fuzz-harness-gen
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# fuzz-harness-gen

Generate `cargo-fuzz` targets for Rust cryptographic libraries and applications.

**This skill is user-triggered only.** It must never be auto-invoked by the
audit router or any other skill. Fuzz runs can be expensive (default timeout:
10 minutes per target via `FUZZ_TIME_LIMIT` and `FUZZ_MAX_ITERS`).

## When to Use

- User explicitly requests fuzz testing
- User invokes this skill by name
- A Phase 2 finding needs additional crash/DoS or logic-divergence evidence

## When NOT to Use

- Never auto-trigger from audit flow
- Never run without explicit user request
- Code is not Rust
- cargo-fuzz is not installed (detect and warn)

## Prerequisites

Before generating targets, verify cargo-fuzz is available:

```bash
cargo fuzz --version 2>/dev/null || echo "ERROR: cargo-fuzz not installed. Install with: cargo install cargo-fuzz"
```

If not installed, inform the user and stop.

## Core Target Categories

1. **Deserialization** — reject malformed inputs without panic
2. **Point decompression** — invalid encodings must fail safely
3. **Proof verification** — malformed proofs should be rejected, not panic
4. **Hash and transcript APIs** — odd-length/context inputs should fail closed
5. **Parser/state transitions** — random byte streams should not trigger UB or invariant breaks

## Budget and Fallback Controls

- Override fuzz run duration with `FUZZ_TIME_LIMIT` (default `600`)
- Override fuzz iteration cap with `FUZZ_MAX_ITERS` when deterministic bounds are needed
- Use optional `PROPTEST_CASES` for lightweight `proptest` checks when full fuzzing is unavailable

## Workflow

### Phase 1: Identify fuzz-worthy surfaces

- Read the target code and public APIs
- Prioritize parser, deserializer, verifier, and boundary-heavy functions
- Read `references/fuzz-checklist.md` for setup requirements

### Phase 2: Generate targets

- Read `references/target-patterns.md` for templates
- Generate `fuzz_target!` harnesses with minimal adapters
- Seed corpus when available and set `FUZZ_TIME_LIMIT` / `FUZZ_MAX_ITERS` bounds

### Phase 3: Execute and triage

- Run `cargo fuzz run ` with `FUZZ_TIME_LIMIT` / `FUZZ_MAX_ITERS` budget controls
- Classify crashes as panic/DoS vs logic/soundness implications
- Preserve crash artifacts for reproducible PoC evidence
- If fuzzing is unavailable, run bounded `proptest` checks (`PROPTEST_CASES`) and label evidence accordingly

## Output Contract

Produce fuzzing results that include:

- The generated target code
- The API/property surface being fuzzed
- Run budget and corpus strategy used
- PASS (no crash found in budget) or FAIL (crash/input found)
- If FAIL: minimized crashing input and reproduction command

## Reference Index

- [references/fuzz-checklist.md](references/fuzz-checklist.md)
- [references/target-patterns.md](references/target-patterns.md)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Yue-Zhou1](https://github.com/Yue-Zhou1)
- **Source:** [Yue-Zhou1/zkcrypto-audit](https://github.com/Yue-Zhou1/zkcrypto-audit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-yue-zhou1-zkcrypto-audit-fuzz-harness-gen
- Seller: https://agentstack.voostack.com/s/yue-zhou1
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.