continuous-fuzzing_skill

Overview

This skill applies Google's continuous fuzzing methodology using OSS-Fuzz and ClusterFuzz to make fuzzing a continuously running quality gate. It focuses on coverage-guided fuzzing, sanitizer builds, automated triage, corpus management, and CI/CD integration to find and prevent security and stability regressions. The goal is to shift fuzzing from an occasional activity into an integral part of the development lifecycle.

How this skill works

The skill automates build instrumentation with sanitizers and fuzzing engines (LibFuzzer, AFL++, Atheris) and runs fuzz targets continuously on clusters or CI runners. It captures and minimizes crashes, deduplicates reports, produces reproduceable testcases, and adds reproducers to a regression corpus. Coverage and corpus metrics are tracked over time to ensure progress and guide seed corpus selection. Integration hooks allow automatic filing, triage, and verification of fixes.

When to use it

• When you need continuous discovery of security vulnerabilities and memory errors.
• When integrating fuzzing into CI/CD so every commit is exercised by fuzzers.
• When you want automated crash triage, deduplication, and reproducible reporters.
• When you need to maintain and grow a corpus to increase coverage over time.
• When building testing infrastructure for libraries, parsers, protocols, or format-handling code.

Best practices

• Always compile with appropriate sanitizers (ASan, MSan, UBSan) and enable fuzzer instrumentation.
• Seed the corpus with real inputs and unit-test outputs; keep and expand the corpus rather than discarding it.
• Prefer coverage-guided engines (LibFuzzer, AFL++) and structure-aware targets for complex formats.
• Integrate fuzz runs into CI schedules and nightly clusters; treat fuzzing results as failing conditions when crashes are new.
• Automate triage, minimization, and regression test addition to close the loop on found bugs.

Example use cases

• Add Atheris-based fuzz targets to a Python JSON/XML parser and run them in CI to catch parser crashes.
• Create LibFuzzer targets for a C/C++ image decoder, run continuously on OSS-Fuzz, and feed reproducers back into the repo as regression tests.
• Use a corpus manager to collect inputs from production telemetry, minimize them, and drive deeper coverage with structure-aware fuzzing.
• Install nightly ClusterFuzz jobs for a networking library to detect regressions introduced by dependency updates.
• Automate crash filing and deduplication so triage teams receive actionable, minimized reproducers with sanitizer stack traces.