[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F3Y9WSD2QX4VCJSF2T64AC":3,"skill-same:01M6F3Y9WSD2QX4VCJSF2T64AC":47},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":29,"ownerHtmlUrl":30,"ownerBlogUrl":6,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M6F3Y9WSD2QX4VCJSF2T64AC","cargo-fuzz",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FelizaOS\u002Feliza\u002Fcargo-fuzz\u002FSKILL.md",[],[18,19],"cargo","cargo fuzz","2026-11-10 10:12:30",false,"# cargo-fuzz\n\ncargo-fuzz is the de facto choice for fuzzing Rust projects when using Cargo. It uses libFuzzer as the backend and provides a convenient Cargo subcommand that automatically enables relevant compilation flags for your Rust project, including support for sanitizers like AddressSanitizer.\n\n## When to Use\n\ncargo-fuzz is currently the primary and most mature fuzzing solution for Rust projects using Cargo.\n\n| Fuzzer | Best For | Complexity |\n|--------|----------|------------|\n| cargo-fuzz | Cargo-based Rust projects, quick setup | Low |\n| AFL++ | Multi-core fuzzing, non-Cargo projects | Medium |\n| LibAFL | Custom fuzzers, research, advanced use cases | High |\n\n**Choose cargo-fuzz when:**\n- Your project uses Cargo (required)\n- You want simple, quick setup with minimal configuration\n- You need integrated sanitizer support\n- You're fuzzing Rust code with or without unsafe blocks\n\n## Quick Start\n\n```rust\n#![no_main]\n\nuse libfuzzer_sys::fuzz_target;\n\nfn harness(data: &[u8]) {\n    your_project::check_buf(data);\n}\n\nfuzz_target!(|data: &[u8]| {\n    harness(data);\n});\n```\n\nInitialize and run:\n```bash\ncargo fuzz init\n# Edit fuzz\u002Ffuzz_targets\u002Ffuzz_target_1.rs with your harness\ncargo +nightly fuzz run fuzz_target_1\n```\n\n## Installation\n\ncargo-fuzz requires the nightly Rust toolchain because it uses features only available in nightly.\n\n### Prerequisites\n\n- Rust and Cargo installed via [rustup](https:\u002F\u002Frustup.rs\u002F)\n- Nightly toolchain\n\n### Linux\u002FmacOS\n\n```bash\n# Install nightly toolchain\nrustup install nightly\n\n# Install cargo-fuzz\ncargo install cargo-fuzz\n```\n\n### Verification\n\n```bash\ncargo +nightly --version\ncargo fuzz --version\n```\n\n## Writing a Harness\n\n### Project Structure\n\ncargo-fuzz works best when your code is structured as a library crate. If you have a binary project, split your `main.rs` into:\n\n```text\nsrc\u002Fmain.rs  # Entry point (main function)\nsrc\u002Flib.rs   # Code to fuzz (public functions)\nCargo.toml\n```\n\nInitialize fuzzing:\n```bash\ncargo fuzz init\n```\n\nThis creates:\n```text\nfuzz\u002F\n├── Cargo.toml\n└── fuzz_targets\u002F\n    └── fuzz_target_1.rs\n```\n\n### Harness Structure\n\n```rust\n#![no_main]\n\nuse libfuzzer_sys::fuzz_target;\n\nfn harness(data: &[u8]) {\n    \u002F\u002F 1. Validate input size if needed\n    if data.is_empty() {\n        return;\n    }\n\n    \u002F\u002F 2. Call target function with fuzz data\n    your_project::target_function(data);\n}\n\nfuzz_target!(|data: &[u8]| {\n    harness(data);\n});\n```\n\n### Harness Rules\n\n| Do | Don't |\n|----|-------|\n| Structure code as library crate | Keep everything in main.rs |\n| Use `fuzz_target!` macro | Write custom main function |\n| Handle `Result::Err` gracefully | Panic on expected errors |\n| Keep harness deterministic | Use random number generators |\n\n> **See Also:** For detailed harness writing techniques and structure-aware fuzzing with the\n> `arbitrary` crate, see the **fuzz-harness-writing** technique skill.\n\n## Structure-Aware Fuzzing\n\ncargo-fuzz integrates with the [arbitrary](https:\u002F\u002Fgithub.com\u002Frust-fuzz\u002Farbitrary) crate for structure-aware fuzzing:\n\n```rust\n\u002F\u002F In your library crate\nuse arbitrary::Arbitrary;\n\n#[derive(Debug, Arbitrary)]\npub struct Name {\n    data: String\n}\n```\n\n```rust\n\u002F\u002F In your fuzz target\n#![no_main]\nuse libfuzzer_sys::fuzz_target;\n\nfuzz_target!(|data: your_project::Name| {\n    data.check_buf();\n});\n```\n\nAdd to your library's `Cargo.toml`:\n```toml\n[dependencies]\narbitrary = { version = \"1\", features = [\"derive\"] }\n```\n\n## Running Campaigns\n\n### Basic Run\n\n```bash\ncargo +nightly fuzz run fuzz_target_1\n```\n\n### Without Sanitizers (Safe Rust)\n\nIf your project doesn't use unsafe Rust, disable sanitizers for 2x performance boost:\n\n```bash\ncargo +nightly fuzz run --sanitizer none fuzz_target_1\n```\n\nCheck if your project uses unsafe code:\n```bash\ncargo install cargo-geiger\ncargo geiger\n```\n\n### Re-executing Test Cases\n\n```bash\n# Run a specific test case (e.g., a crash)\ncargo +nightly fuzz run fuzz_target_1 fuzz\u002Fartifacts\u002Ffuzz_target_1\u002Fcrash-\u003Chash>\n\n# Run all corpus entries without fuzzing\ncargo +nightly fuzz run fuzz_target_1 fuzz\u002Fcorpus\u002Ffuzz_target_1 -- -runs=0\n```\n\n### Using Dictionaries\n\n```bash\ncargo +nightly fuzz run fuzz_target_1 -- -dict=.\u002Fdict.dict\n```\n\n### Interpreting Output\n\n| Output | Meaning |\n|--------|---------|\n| `NEW` | New coverage-increasing input discovered |\n| `pulse` | Periodic status update |\n| `INITED` | Fuzzer initialized successfully |\n| Crash with stack trace | Bug found, saved to `fuzz\u002Fartifacts\u002F` |\n\nCorpus location: `fuzz\u002Fcorpus\u002Ffuzz_target_1\u002F`\nCrashes location: `fuzz\u002Fartifacts\u002Ffuzz_target_1\u002F`\n\n## Sanitizer Integration\n\n### AddressSanitizer (ASan)\n\nASan is enabled by default and detects memory errors:\n\n```bash\ncargo +nightly fuzz run fuzz_target_1\n```\n\n### Disabling Sanitizers\n\nFor pure safe Rust (no unsafe blocks in your code or dependencies):\n\n```bash\ncargo +nightly fuzz run --sanitizer none fuzz_target_1\n```\n\n**Performance impact:** ASan adds ~2x overhead. Disable for safe Rust to improve fuzzing speed.\n\n### Checking for Unsafe Code\n\n```bash\ncargo install cargo-geiger\ncargo geiger\n```\n\n> **See Also:** For detailed sanitizer configuration, flags, and troubleshooting,\n> see the **address-sanitizer** technique skill.\n\n## Coverage Analysis\n\ncargo-fuzz integrates with Rust's coverage tools to analyze fuzzing effectiveness.\n\n### Prerequisites\n\n```bash\nrustup toolchain install nightly --component llvm-tools-preview\ncargo install cargo-binutils\ncargo install rustfilt\n```\n\n### Generating Coverage Reports\n\n```bash\n# Generate coverage data from corpus\ncargo +nightly fuzz coverage fuzz_target_1\n```\n\nCreate coverage generation script:\n\n```bash\ncat \u003C\u003C'EOF' > .\u002Fgenerate_html\n#!\u002Fbin\u002Fsh\nif [ $# -lt 1 ]; then\n    echo \"Error: Name of fuzz target is required.\"\n    echo \"Usage: $0 fuzz_target [sources...]\"\n    exit 1\nfi\nFUZZ_TARGET=\"$1\"\nshift\nSRC_FILTER=\"$@\"\nTARGET=$(rustc -vV | sed -n 's|host: ||p')\ncargo +nightly cov -- show -Xdemangler=rustfilt \\\n  \"target\u002F$TARGET\u002Fcoverage\u002F$TARGET\u002Frelease\u002F$FUZZ_TARGET\" \\\n  -instr-profile=\"fuzz\u002Fcoverage\u002F$FUZZ_TARGET\u002Fcoverage.profdata\"  \\\n  -show-line-counts-or-regions -show-instantiations  \\\n  -format=html -o fuzz_html\u002F $SRC_FILTER\nEOF\nchmod +x .\u002Fgenerate_html\n```\n\nGenerate HTML report:\n```bash\n.\u002Fgenerate_html fuzz_target_1 src\u002Flib.rs\n```\n\nHTML report saved to: `fuzz_html\u002F`\n\n> **See Also:** For detailed coverage analysis techniques and systematic coverage improvement,\n> see the **coverage-analysis** technique skill.\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Start with a seed corpus | Dramatically speeds up initial coverage discovery |\n| Use `--sanitizer none` for safe Rust | 2x performance improvement |\n| Check coverage regularly | Identifies gaps in harness or seed corpus |\n| Use dictionaries for parsers | Helps overcome magic value checks |\n| Structure code as library | Required for cargo-fuzz integration |\n\n### libFuzzer Options\n\nPass options to libFuzzer after `--`:\n\n```bash\n# See all options\ncargo +nightly fuzz run fuzz_target_1 -- -help=1\n\n# Set timeout per run\ncargo +nightly fuzz run fuzz_target_1 -- -timeout=10\n\n# Use dictionary\ncargo +nightly fuzz run fuzz_target_1 -- -dict=dict.dict\n\n# Limit maximum input size\ncargo +nightly fuzz run fuzz_target_1 -- -max_len=1024\n```\n\n### Multi-Core Fuzzing\n\n```bash\n# Experimental forking support (not recommended)\ncargo +nightly fuzz run --jobs 1 fuzz_target_1\n```\n\nNote: The multi-core fuzzing feature is experimental and not recommended. For parallel fuzzing, consider running multiple instances manually or using AFL++.\n\n## Real-World Examples\n\n### Example: ogg Crate\n\nThe [ogg crate](https:\u002F\u002Fgithub.com\u002FRustAudio\u002Fogg) parses Ogg media container files. Parsers are excellent fuzzing targets because they handle untrusted data.\n\n```bash\n# Clone and initialize\ngit clone https:\u002F\u002Fgithub.com\u002FRustAudio\u002Fogg.git\ncd ogg\u002F\ncargo fuzz init\n```\n\nHarness at `fuzz\u002Ffuzz_targets\u002Ffuzz_target_1.rs`:\n\n```rust\n#![no_main]\n\nuse ogg::{PacketReader, PacketWriter};\nuse ogg::writing::PacketWriteEndInfo;\nuse std::io::Cursor;\nuse libfuzzer_sys::fuzz_target;\n\nfn harness(data: &[u8]) {\n    let mut pck_rdr = PacketReader::new(Cursor::new(data.to_vec()));\n    pck_rdr.delete_unread_packets();\n\n    let output = Vec::new();\n    let mut pck_wtr = PacketWriter::new(Cursor::new(output));\n\n    if let Ok(_) = pck_rdr.read_packet() {\n        if let Ok(r) = pck_rdr.read_packet() {\n            match r {\n                Some(pck) => {\n                    let inf = if pck.last_in_stream() {\n                        PacketWriteEndInfo::EndStream\n                    } else if pck.last_in_page() {\n                        PacketWriteEndInfo::EndPage\n                    } else {\n                        PacketWriteEndInfo::NormalPacket\n                    };\n                    let stream_serial = pck.stream_serial();\n                    let absgp_page = pck.absgp_page();\n                    let _ = pck_wtr.write_packet(\n                        pck.data, stream_serial, inf, absgp_page\n                    );\n                }\n                None => return,\n            }\n        }\n    }\n}\n\nfuzz_target!(|data: &[u8]| {\n    harness(data);\n});\n```\n\nSeed the corpus:\n```bash\nmkdir fuzz\u002Fcorpus\u002Ffuzz_target_1\u002F\ncurl -o fuzz\u002Fcorpus\u002Ffuzz_target_1\u002F320x240.ogg \\\n  https:\u002F\u002Fcommons.wikimedia.org\u002Fwiki\u002FFile:320x240.ogg\n```\n\nRun:\n```bash\ncargo +nightly fuzz run fuzz_target_1\n```\n\nAnalyze coverage:\n```bash\ncargo +nightly fuzz coverage fuzz_target_1\n.\u002Fgenerate_html fuzz_target_1 src\u002Flib.rs\n```\n\n## Troubleshooting\n\n| Problem | Cause | Solution |\n|---------|-------|----------|\n| \"requires nightly\" error | Using stable toolchain | Use `cargo +nightly fuzz` |\n| Slow fuzzing performance | ASan enabled for safe Rust | Add `--sanitizer none` flag |\n| \"cannot find binary\" | No library crate | Move code from `main.rs` to `lib.rs` |\n| Sanitizer compilation issues | Wrong nightly version | Try different nightly: `rustup install nightly-2024-01-01` |\n| Low coverage | Missing seed corpus | Add sample inputs to `fuzz\u002Fcorpus\u002Ffuzz_target_1\u002F` |\n| Magic value not found | No dictionary | Create dictionary file with magic values |\n\n## Related Skills\n\n### Technique Skills\n\n| Skill | Use Case |\n|-------|----------|\n| **fuzz-harness-writing** | Structure-aware fuzzing with `arbitrary` crate |\n| **address-sanitizer** | Understanding ASan output and configuration |\n| **coverage-analysis** | Measuring and improving fuzzing effectiveness |\n| **fuzzing-corpus** | Building and managing seed corpora |\n| **fuzzing-dictionaries** | Creating dictionaries for format-aware fuzzing |\n\n### Related Fuzzers\n\n| Skill | When to Consider |\n|-------|------------------|\n| **libfuzzer** | Fuzzing C\u002FC++ code with similar workflow |\n| **aflpp** | Multi-core fuzzing or non-Cargo Rust projects |\n| **libafl** | Advanced fuzzing research or custom fuzzer development |\n\n## Resources\n\n**[Rust Fuzz Book - cargo-fuzz](https:\u002F\u002Frust-fuzz.github.io\u002Fbook\u002Fcargo-fuzz.html)**\nOfficial documentation for cargo-fuzz covering installation, usage, and advanced features.\n\n**[arbitrary crate documentation](https:\u002F\u002Fdocs.rs\u002Farbitrary\u002Flatest\u002Farbitrary\u002F)**\nGuide to structure-aware fuzzing with automatic derivation for Rust types.\n\n**[cargo-fuzz GitHub Repository](https:\u002F\u002Fgithub.com\u002Frust-fuzz\u002Fcargo-fuzz)**\nSource code, issue tracker, and examples for cargo-fuzz.\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FelizaOS\u002Feliza\u002Fcargo-fuzz",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill cargo-fuzz",{"tool":39,"command":40},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill cargo-fuzz",{"tool":42,"command":43},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill cargo-fuzz","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FelizaOS\u002Feliza\u002Fcargo-fuzz\u002FSKILL.md",true,[],[48,62,72,81,87,94],{"skillNo":49,"name":50,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":51,"categories":52,"keywords":58,"publishedAt":20},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[53],{"categoryNo":54,"categoryName":55,"taxonomyType":56,"taxonomyTypeDesc":57},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[59,60,61],"model","model hierarchy","model hierarchy skill",{"skillNo":63,"name":64,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":68,"publishedAt":20},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[67],{"categoryNo":54,"categoryName":55,"taxonomyType":56,"taxonomyTypeDesc":57},[69,70,71],"MCP","zoom","zoom mcp",{"skillNo":73,"name":74,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":20},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[78,79,80,70],"sdk","zoom apps sdk","apps",{"skillNo":82,"name":83,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":20},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[83],{"skillNo":88,"name":89,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":93,"publishedAt":20},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[92],{"categoryNo":54,"categoryName":55,"taxonomyType":56,"taxonomyTypeDesc":57},[89],{"skillNo":95,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":20},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[96]]