CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/afl-plus-plus

Author and run AFL++ - out-of-process coverage-guided fuzzer (a community fork of Google's original AFL with improved mutations and instrumentation). Covers afl-cc / afl-clang-fast instrumented build, afl-fuzz invocation, parallel master/slave (-M / -S), dictionary support (-x), QEMU mode (-Q) for binaries without source, output structure (queue / crashes / hangs), crash minimisation (afl-tmin), corpus minimisation (afl-cmin), crash filename triage, and CI integration. Use for fuzzing standalone binaries (file processors, command-line tools) where libFuzzer's in-process model doesn't fit; for cross-fuzzer corpus strategy see corpus-management-reference.

80

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tight, actionable AFL++ runbook covering build, run, triage, and CI with executable commands and useful non-obvious operational details. Organization is clear and free of generic filler.

DimensionReasoningScore

Conciseness

A lean runbook of commands and tables plus AFL-specific facts Claude lacks (crash filename encoding, output structure, exec/sec comparisons) with no generic 'what is fuzzing' padding — every token earns its place.

3 / 3

Actionability

Provides fully executable, copy-paste-ready commands for install, instrumentation, invocation, parallel/QEMU modes, tmin/cmin, and a complete CI workflow YAML.

3 / 3

Workflow Clarity

A clearly sequenced Install → Instrument → Run → Parse → Triage → CI runbook with concrete crash-reproduction steps and an Anti-patterns guardrail table; no destructive/batch operation requires an absent validate-fix-retry loop.

3 / 3

Progressive Disclosure

A single, well-sectioned SKILL.md with no bundle files; cross-skill pointers (Composes/Sibling fuzzers/Dispatcher) are one level deep and clearly signaled.

3 / 3

Total

12

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and clearly scoped to AFL++'s out-of-process niche with an explicit 'Use for' clause. It distinguishes itself well from libFuzzer and sibling fuzzing skills.

DimensionReasoningScore

Specificity

Lists many concrete actions — 'afl-cc / afl-clang-fast instrumented build, afl-fuzz invocation, parallel master/slave (-M / -S)... crash minimisation (afl-tmin), corpus minimisation (afl-cmin)' — matching the 'lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Answers both what ('Author and run AFL++... Covers [list]') and when with an explicit trigger clause ('Use for fuzzing standalone binaries...'), not merely implied.

3 / 3

Trigger Term Quality

Natural terms a user would say are present — 'fuzzing standalone binaries (file processors, command-line tools)' and 'where libFuzzer's in-process model doesn't fit' — giving good coverage rather than only some relevant keywords.

3 / 3

Distinctiveness Conflict Risk

Has a clear niche (out-of-process coverage-guided fuzzer) and explicitly distinguishes itself from libFuzzer and sibling fuzzers, making wrong-skill triggering unlikely.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents