CtrlK
BlogDocsLog inGet started
Tessl Logo

offensive-fuzzing

Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.

76

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

SKILL.md
Quality
Evals
Security

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, dense reference skill with executable code and commands throughout and a clearly sequenced workflow. Main gap is the absence of explicit validation checkpoints gating the build/harness phases, and a single-file structure where some specialized-target detail could live in separate reference files.

Suggestions

Add an explicit validate-then-proceed checkpoint between harness build and fuzz launch (e.g., confirm the harness runs a single seed without sanitizer errors before scaling up) to strengthen the feedback loop for this batch operation.

Consider splitting the lengthy 'Specialized Targets' section and the 'Tool Index' into one-level-deep reference files (e.g., TARGETS.md, TOOLS.md) with concise pointers from SKILL.md to improve progressive disclosure.

Add a short 'crash reproducibility' verification step inside the triage workflow that re-runs the minimized crash under the recorded sanitizer options to confirm it reproduces before bucketing.

DimensionReasoningScore

Conciseness

Dense, reference-style content that assumes Claude's domain competence throughout — no beginner explanations of what fuzzers or sanitizers are — so every line earns its place despite the length.

5 / 5

Actionability

Fully executable, copy-paste-ready guidance across the board: build commands, harness source, fuzz launch invocations, triage pipelines, syzkaller config, and CI YAML covering the common cases.

5 / 5

Workflow Clarity

The core workflow is clearly sequenced ('Research target → ... → Triage → Report') and expanded in numbered steps 1–7, with a 'Monitor and Unstick' feedback loop and explicit triage sub-steps, but the build/harness phases lack an explicit validate-before-proceeding checkpoint.

4 / 5

Progressive Disclosure

Well-organized into clear sections (Fuzzer Types, Core Workflow, Oracle Selection, Specialized Targets, CI/CD, Tool Index) with no nested references, though it is a single inlined file over 50 lines rather than an overview pointing to one-level-deep reference files.

4 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person, concrete, and explicit about both capabilities and trigger conditions, with named tools and target types that make it highly distinctive. No vague fluff or over-claims.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'target identification, fuzzer selection (...), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage' — giving comprehensive coverage of the methodology's components.

5 / 5

Completeness

Explicitly answers both what (the named methodology components) and when ('Use when setting up or running fuzz campaigns against any target: ...') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Comprehensive natural-term coverage including synonyms and target variants: 'fuzz campaigns', 'file parsers', 'network protocols', 'kernel drivers', 'EDR engines', 'embedded firmware', 'language runtimes', alongside specific tool names.

5 / 5

Distinctiveness Conflict Risk

Clear offensive-fuzzing niche with named tools and specific target classes; the 'Use when setting up or running fuzz campaigns' trigger minimizes overlap with unrelated skills.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 1 missing

Warning

Total

15

/

16

Passed

Repository
SnailSploit/Claude-Red
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.