[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF4T16VYH6468NNSAW97ZH":3,"skill-same:01M6AF4T16VYH6468NNSAW97ZH":148},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":29,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":81,"commitSha":82,"skillDirectory":83,"forksCount":84,"repositoryHtmlUrl":85,"repositoryHomepageUrl":86,"ownerHtmlUrl":87,"ownerBlogUrl":88,"ownerDescription":89,"updatedAt":90,"install":91,"resources":104},"01M6AF4T16VYH6468NNSAW97ZH","implementing-fuzz-testing-in-cicd-with-aflplusplus",null,"Integrates AFL++ coverage-guided fuzzing into CI\u002FCD pipelines, covering harness construction, AFL++\u002FAddressSanitizer\u002FCmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C\u002FC++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native\u002Fcompiled applications.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"implementing fuzz testing in cicd with aflplusplus","cicd","fuzz testing","testing","ci","fuzz-testing","aflplusplus","applications","Safety","t1195","t1059","pipeline","harness","code","pr","fuzzing","cybersecurity","memory","security","devsecops","2026-11-10 10:12:30",false,"---\nname: implementing-fuzz-testing-in-cicd-with-aflplusplus\ndescription: Integrates AFL++ coverage-guided fuzzing into CI\u002FCD pipelines, covering harness construction, AFL++\u002FAddressSanitizer\u002FCmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C\u002FC++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native\u002Fcompiled applications.\ndomain: cybersecurity\nsubdomain: devsecops\ntags:\n- aflplusplus\n- fuzz-testing\n- cicd\n- coverage-guided-fuzzing\n- security-testing\n- vulnerability-discovery\n- afl\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.PS-01\n- GV.SC-07\n- ID.IM-04\n- PR.PS-04\nmitre_attack:\n- T1195\n- T1554\n- T1059.004\n- T1005\n- T1059\n---\n\n# Implementing Fuzz Testing in CI\u002FCD with AFL++\n\n## Overview\n\nAFL++ (American Fuzzy Lop Plus Plus) is a community-maintained fork of AFL that provides state-of-the-art coverage-guided fuzz testing for discovering vulnerabilities in compiled applications. AFL++ uses genetic algorithms to mutate inputs, tracking code coverage to find new execution paths that trigger crashes, hangs, and undefined behavior. In CI\u002FCD environments, AFL++ can be integrated to continuously test parsers, protocol handlers, file format processors, and any code that handles untrusted input. AFL++ supports persistent mode for high-speed fuzzing (up to 100,000+ executions per second), custom mutators, QEMU mode for binary-only fuzzing, and CmpLog\u002FRedQueen for automatic dictionary extraction.\n\n\n## When to Use\n\n- When deploying or configuring implementing fuzz testing in cicd with aflplusplus capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Linux-based CI runners (AFL++ does not support Windows natively)\n- GCC or Clang compiler toolchain\n- AFL++ installed (`apt install aflplusplus` or built from source)\n- Target application with harness functions isolating input processing\n- Seed corpus of valid input samples\n\n## Core Concepts\n\n### Coverage-Guided Fuzzing\n\nAFL++ instruments the target binary at compile time (or via QEMU\u002FFrida for binary-only targets) to track which code paths each input exercises. When a mutated input triggers a new code path, it is saved to the corpus for further mutation. This feedback loop enables AFL++ to systematically explore program state space.\n\n### Instrumentation Modes\n\n| Mode | Use Case | Performance |\n|------|----------|-------------|\n| `afl-clang-fast` (LTO) | Source available, best performance | Highest |\n| `afl-clang-fast` | Source available, standard | High |\n| `afl-gcc-fast` | GCC-based projects | High |\n| `QEMU mode` | Binary-only, no source | Medium |\n| `Frida mode` | Binary-only, cross-platform | Medium |\n| `Unicorn mode` | Firmware, embedded | Low |\n\n### Persistent Mode\n\nPersistent mode avoids fork overhead by fuzzing within a loop:\n\n```c\n#include \u003Cunistd.h>\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        \u002F\u002F Process buf[0..len-1]\n        parse_input(buf, len);\n    }\n    return 0;\n}\n```\n\n## Workflow\n\n### Step 1 --- Build the Fuzzing Harness\n\nCreate a harness that feeds AFL++ input to the target function:\n\n```c\n\u002F\u002F fuzz_harness.c\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cstring.h>\n#include \"target_parser.h\"\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        if (len \u003C 4) continue;\n\n        \u002F\u002F Reset state between iterations\n        parser_context_t ctx;\n        parser_init(&ctx);\n        parser_process(&ctx, buf, len);\n        parser_cleanup(&ctx);\n    }\n    return 0;\n}\n```\n\n### Step 2 --- Compile with AFL++ Instrumentation\n\n```bash\n# Standard instrumentation\nexport CC=afl-clang-fast\nexport CXX=afl-clang-fast++\n\n# Enable AddressSanitizer for better crash detection\nexport AFL_USE_ASAN=1\n\n# Build the target with instrumentation\n$CC -o fuzz_harness fuzz_harness.c -ltarget_parser -fsanitize=address\n\n# Build a CmpLog binary for better coverage\n$CC -o fuzz_harness_cmplog fuzz_harness.c -ltarget_parser \\\n  -fsanitize=address -DCMPLOG\n```\n\n### Step 3 --- Prepare Seed Corpus\n\n```bash\nmkdir -p corpus\u002F\n# Add valid input samples\ncp test_inputs\u002F* corpus\u002F\n# Minimize the corpus\nafl-cmin -i corpus\u002F -o corpus_min\u002F -- .\u002Ffuzz_harness @@\n# Further minimize individual inputs\nmkdir -p corpus_tmin\u002F\nfor f in corpus_min\u002F*; do\n    afl-tmin -i \"$f\" -o \"corpus_tmin\u002F$(basename $f)\" -- .\u002Ffuzz_harness @@\ndone\n```\n\n### Step 4 --- Configure CI\u002FCD Integration\n\n**GitHub Actions:**\n\n```yaml\nname: Fuzz Testing\non:\n  push:\n    branches: [main]\n  schedule:\n    - cron: '0 2 * * *'  # Nightly fuzzing\n\njobs:\n  fuzz:\n    runs-on: ubuntu-latest\n    timeout-minutes: 120\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Install AFL++\n        run: |\n          sudo apt-get update\n          sudo apt-get install -y aflplusplus\n\n      - name: Restore corpus cache\n        uses: actions\u002Fcache@v4\n        with:\n          path: corpus\u002F\n          key: fuzz-corpus-${{ github.sha }}\n          restore-keys: fuzz-corpus-\n\n      - name: Build fuzzing harness\n        run: |\n          export CC=afl-clang-fast\n          export AFL_USE_ASAN=1\n          make fuzz_harness\n\n      - name: Run AFL++ fuzzing (CI mode)\n        env:\n          AFL_CMPLOG_ONLY_NEW: 1\n          AFL_FAST_CAL: 1\n          AFL_NO_STARTUP_CALIBRATION: 1\n        run: |\n          mkdir -p findings\u002F\n          timeout 7200 afl-fuzz \\\n            -S ci_fuzzer \\\n            -i corpus\u002F \\\n            -o findings\u002F \\\n            -t 5000 \\\n            -- .\u002Ffuzz_harness @@ || true\n\n      - name: Check for crashes\n        run: |\n          CRASHES=$(find findings\u002F -path \"*\u002Fcrashes\u002F*\" -not -name \"README.txt\" | wc -l)\n          echo \"Found $CRASHES unique crashes\"\n          if [ \"$CRASHES\" -gt 0 ]; then\n            echo \"::error::AFL++ found $CRASHES crashes\"\n            for crash in findings\u002F*\u002Fcrashes\u002F*; do\n              [ -f \"$crash\" ] && echo \"Crash: $crash ($(wc -c \u003C $crash) bytes)\"\n            done\n            exit 1\n          fi\n\n      - name: Update corpus cache\n        if: always()\n        run: |\n          afl-cmin -i findings\u002Fci_fuzzer\u002Fqueue\u002F -o corpus\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 5 --- Parallel Fuzzing for Nightly Runs\n\n```bash\n# Launch multiple secondary instances for better coverage\nfor i in $(seq 1 $(nproc)); do\n    afl-fuzz -S fuzzer_$i \\\n      -i corpus\u002F \\\n      -o findings\u002F \\\n      -- .\u002Ffuzz_harness @@ &\ndone\n\n# Wait for all fuzzers\nwait\n\n# Merge and minimize corpus\nafl-cmin -i findings\u002F*\u002Fqueue\u002F -o corpus_merged\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 6 --- Crash Triage\n\n```bash\n# Reproduce and categorize crashes\nfor crash in findings\u002F*\u002Fcrashes\u002F*; do\n    echo \"=== Testing: $crash ===\"\n    timeout 5 .\u002Ffuzz_harness_asan \"$crash\" 2>&1 | head -20\n    echo \"---\"\ndone\n\n# Deduplicate crashes by stack trace\nafl-collect findings\u002F crashes_deduped\u002F -- .\u002Ffuzz_harness @@\n```\n\n## CI\u002FCD Best Practices for AFL++\n\n| Setting | CI Short Run | Nightly Long Run |\n|---------|-------------|-----------------|\n| Duration | 30-60 min | 4-24 hours |\n| Mode | `-S` (secondary only) | `-S` (no `-M` for CI) |\n| `AFL_CMPLOG_ONLY_NEW` | 1 | 1 |\n| `AFL_FAST_CAL` | 1 | 0 |\n| `AFL_NO_STARTUP_CALIBRATION` | 1 | 0 |\n| Corpus caching | Required | Required |\n| Parallel instances | 1-2 | nproc |\n\n## Monitoring Fuzzing Campaigns\n\n```bash\n# View fuzzing statistics\nafl-whatsup findings\u002F\n\n# Key metrics to track:\n# - Total paths found (code coverage indicator)\n# - Unique crashes \u002F unique hangs\n# - Stability percentage (should be >90%)\n# - Exec speed (execs\u002Fsec)\n# - Cycles done (full corpus cycles completed)\n```\n\n## References\n\n- [AFL++ Documentation](https:\u002F\u002Faflplus.plus\u002Fdocs\u002F)\n- [AFL++ GitHub Repository](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus)\n- [AFL++ Fuzzing in Depth Guide](https:\u002F\u002Faflplus.plus\u002Fdocs\u002Ffuzzing_in_depth\u002F)\n- [Google Testing Handbook - AFL++](https:\u002F\u002Fappsec.guide\u002Fdocs\u002Ffuzzing\u002Fc-cpp\u002Faflpp\u002F)\n- [OWASP Fuzzing Guide](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FFuzzing)\n","# Implementing Fuzz Testing in CI\u002FCD with AFL++\n\n## Overview\n\nAFL++ (American Fuzzy Lop Plus Plus) is a community-maintained fork of AFL that provides state-of-the-art coverage-guided fuzz testing for discovering vulnerabilities in compiled applications. AFL++ uses genetic algorithms to mutate inputs, tracking code coverage to find new execution paths that trigger crashes, hangs, and undefined behavior. In CI\u002FCD environments, AFL++ can be integrated to continuously test parsers, protocol handlers, file format processors, and any code that handles untrusted input. AFL++ supports persistent mode for high-speed fuzzing (up to 100,000+ executions per second), custom mutators, QEMU mode for binary-only fuzzing, and CmpLog\u002FRedQueen for automatic dictionary extraction.\n\n\n## When to Use\n\n- When deploying or configuring implementing fuzz testing in cicd with aflplusplus capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Linux-based CI runners (AFL++ does not support Windows natively)\n- GCC or Clang compiler toolchain\n- AFL++ installed (`apt install aflplusplus` or built from source)\n- Target application with harness functions isolating input processing\n- Seed corpus of valid input samples\n\n## Core Concepts\n\n### Coverage-Guided Fuzzing\n\nAFL++ instruments the target binary at compile time (or via QEMU\u002FFrida for binary-only targets) to track which code paths each input exercises. When a mutated input triggers a new code path, it is saved to the corpus for further mutation. This feedback loop enables AFL++ to systematically explore program state space.\n\n### Instrumentation Modes\n\n| Mode | Use Case | Performance |\n|------|----------|-------------|\n| `afl-clang-fast` (LTO) | Source available, best performance | Highest |\n| `afl-clang-fast` | Source available, standard | High |\n| `afl-gcc-fast` | GCC-based projects | High |\n| `QEMU mode` | Binary-only, no source | Medium |\n| `Frida mode` | Binary-only, cross-platform | Medium |\n| `Unicorn mode` | Firmware, embedded | Low |\n\n### Persistent Mode\n\nPersistent mode avoids fork overhead by fuzzing within a loop:\n\n```c\n#include \u003Cunistd.h>\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        \u002F\u002F Process buf[0..len-1]\n        parse_input(buf, len);\n    }\n    return 0;\n}\n```\n\n## Workflow\n\n### Step 1 --- Build the Fuzzing Harness\n\nCreate a harness that feeds AFL++ input to the target function:\n\n```c\n\u002F\u002F fuzz_harness.c\n#include \u003Cstdio.h>\n#include \u003Cstdlib.h>\n#include \u003Cstring.h>\n#include \"target_parser.h\"\n\n__AFL_FUZZ_INIT();\n\nint main() {\n    __AFL_INIT();\n    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;\n\n    while (__AFL_LOOP(10000)) {\n        int len = __AFL_FUZZ_TESTCASE_LEN;\n        if (len \u003C 4) continue;\n\n        \u002F\u002F Reset state between iterations\n        parser_context_t ctx;\n        parser_init(&ctx);\n        parser_process(&ctx, buf, len);\n        parser_cleanup(&ctx);\n    }\n    return 0;\n}\n```\n\n### Step 2 --- Compile with AFL++ Instrumentation\n\n```bash\n# Standard instrumentation\nexport CC=afl-clang-fast\nexport CXX=afl-clang-fast++\n\n# Enable AddressSanitizer for better crash detection\nexport AFL_USE_ASAN=1\n\n# Build the target with instrumentation\n$CC -o fuzz_harness fuzz_harness.c -ltarget_parser -fsanitize=address\n\n# Build a CmpLog binary for better coverage\n$CC -o fuzz_harness_cmplog fuzz_harness.c -ltarget_parser \\\n  -fsanitize=address -DCMPLOG\n```\n\n### Step 3 --- Prepare Seed Corpus\n\n```bash\nmkdir -p corpus\u002F\n# Add valid input samples\ncp test_inputs\u002F* corpus\u002F\n# Minimize the corpus\nafl-cmin -i corpus\u002F -o corpus_min\u002F -- .\u002Ffuzz_harness @@\n# Further minimize individual inputs\nmkdir -p corpus_tmin\u002F\nfor f in corpus_min\u002F*; do\n    afl-tmin -i \"$f\" -o \"corpus_tmin\u002F$(basename $f)\" -- .\u002Ffuzz_harness @@\ndone\n```\n\n### Step 4 --- Configure CI\u002FCD Integration\n\n**GitHub Actions:**\n\n```yaml\nname: Fuzz Testing\non:\n  push:\n    branches: [main]\n  schedule:\n    - cron: '0 2 * * *'  # Nightly fuzzing\n\njobs:\n  fuzz:\n    runs-on: ubuntu-latest\n    timeout-minutes: 120\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Install AFL++\n        run: |\n          sudo apt-get update\n          sudo apt-get install -y aflplusplus\n\n      - name: Restore corpus cache\n        uses: actions\u002Fcache@v4\n        with:\n          path: corpus\u002F\n          key: fuzz-corpus-${{ github.sha }}\n          restore-keys: fuzz-corpus-\n\n      - name: Build fuzzing harness\n        run: |\n          export CC=afl-clang-fast\n          export AFL_USE_ASAN=1\n          make fuzz_harness\n\n      - name: Run AFL++ fuzzing (CI mode)\n        env:\n          AFL_CMPLOG_ONLY_NEW: 1\n          AFL_FAST_CAL: 1\n          AFL_NO_STARTUP_CALIBRATION: 1\n        run: |\n          mkdir -p findings\u002F\n          timeout 7200 afl-fuzz \\\n            -S ci_fuzzer \\\n            -i corpus\u002F \\\n            -o findings\u002F \\\n            -t 5000 \\\n            -- .\u002Ffuzz_harness @@ || true\n\n      - name: Check for crashes\n        run: |\n          CRASHES=$(find findings\u002F -path \"*\u002Fcrashes\u002F*\" -not -name \"README.txt\" | wc -l)\n          echo \"Found $CRASHES unique crashes\"\n          if [ \"$CRASHES\" -gt 0 ]; then\n            echo \"::error::AFL++ found $CRASHES crashes\"\n            for crash in findings\u002F*\u002Fcrashes\u002F*; do\n              [ -f \"$crash\" ] && echo \"Crash: $crash ($(wc -c \u003C $crash) bytes)\"\n            done\n            exit 1\n          fi\n\n      - name: Update corpus cache\n        if: always()\n        run: |\n          afl-cmin -i findings\u002Fci_fuzzer\u002Fqueue\u002F -o corpus\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 5 --- Parallel Fuzzing for Nightly Runs\n\n```bash\n# Launch multiple secondary instances for better coverage\nfor i in $(seq 1 $(nproc)); do\n    afl-fuzz -S fuzzer_$i \\\n      -i corpus\u002F \\\n      -o findings\u002F \\\n      -- .\u002Ffuzz_harness @@ &\ndone\n\n# Wait for all fuzzers\nwait\n\n# Merge and minimize corpus\nafl-cmin -i findings\u002F*\u002Fqueue\u002F -o corpus_merged\u002F -- .\u002Ffuzz_harness @@\n```\n\n### Step 6 --- Crash Triage\n\n```bash\n# Reproduce and categorize crashes\nfor crash in findings\u002F*\u002Fcrashes\u002F*; do\n    echo \"=== Testing: $crash ===\"\n    timeout 5 .\u002Ffuzz_harness_asan \"$crash\" 2>&1 | head -20\n    echo \"---\"\ndone\n\n# Deduplicate crashes by stack trace\nafl-collect findings\u002F crashes_deduped\u002F -- .\u002Ffuzz_harness @@\n```\n\n## CI\u002FCD Best Practices for AFL++\n\n| Setting | CI Short Run | Nightly Long Run |\n|---------|-------------|-----------------|\n| Duration | 30-60 min | 4-24 hours |\n| Mode | `-S` (secondary only) | `-S` (no `-M` for CI) |\n| `AFL_CMPLOG_ONLY_NEW` | 1 | 1 |\n| `AFL_FAST_CAL` | 1 | 0 |\n| `AFL_NO_STARTUP_CALIBRATION` | 1 | 0 |\n| Corpus caching | Required | Required |\n| Parallel instances | 1-2 | nproc |\n\n## Monitoring Fuzzing Campaigns\n\n```bash\n# View fuzzing statistics\nafl-whatsup findings\u002F\n\n# Key metrics to track:\n# - Total paths found (code coverage indicator)\n# - Unique crashes \u002F unique hangs\n# - Stability percentage (should be >90%)\n# - Exec speed (execs\u002Fsec)\n# - Cycles done (full corpus cycles completed)\n```\n\n## References\n\n- [AFL++ Documentation](https:\u002F\u002Faflplus.plus\u002Fdocs\u002F)\n- [AFL++ GitHub Repository](https:\u002F\u002Fgithub.com\u002FAFLplusplus\u002FAFLplusplus)\n- [AFL++ Fuzzing in Depth Guide](https:\u002F\u002Faflplus.plus\u002Fdocs\u002Ffuzzing_in_depth\u002F)\n- [Google Testing Handbook - AFL++](https:\u002F\u002Fappsec.guide\u002Fdocs\u002Ffuzzing\u002Fc-cpp\u002Faflpp\u002F)\n- [OWASP Fuzzing Guide](https:\u002F\u002Fowasp.org\u002Fwww-community\u002FFuzzing)\n",{"name":5,"tags":55,"author":60,"domain":46,"license":15,"version":61,"nist_csf":62,"subdomain":49,"description":7,"nist_ai_rmf":67,"mitre_attack":71,"atlas_techniques":77},[36,35,31,56,57,58,59],"coverage-guided-fuzzing","security-testing","vulnerability-discovery","afl","mahipal","1.0",[63,64,65,66],"PR.PS-01","GV.SC-07","ID.IM-04","PR.PS-04",[68,69,70],"MEASURE-2.7","MAP-5.1","MANAGE-2.4",[72,73,74,75,76],"T1195","T1554","T1059.004","T1005","T1059",[78,79,80],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":92,"prompt":102,"zipAvailable":103},[93,96,99],{"tool":94,"command":95},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-fuzz-testing-in-cicd-with-aflplusplus",{"tool":97,"command":98},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-fuzz-testing-in-cicd-with-aflplusplus",{"tool":100,"command":101},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-fuzz-testing-in-cicd-with-aflplusplus","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002FSKILL.md",true,[105,111,117,121,126,130,134,138,144],{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"assets\u002Ftemplate.md","ASSET","资产文件",893,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002Fassets\u002Ftemplate.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"contributor.schema.json","REFERENCE","参考文档",3098,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Faiwg-utils\u002Fskills\u002Fproject-status\u002Fcontributor.schema.json",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"heuristic-fallback.md",5162,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Faddons\u002Faiwg-utils\u002Fskills\u002Fproject-status\u002Fheuristic-fallback.md",{"path":122,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002FLICENSE",{"path":127,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fapi-reference.md",2114,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002Freferences\u002Fapi-reference.md",{"path":131,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":132,"sourceHtmlUrl":133},"references\u002Fstandards.md",1800,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002Freferences\u002Fstandards.md",{"path":135,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":136,"sourceHtmlUrl":137},"references\u002Fworkflows.md",1416,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002Freferences\u002Fworkflows.md",{"path":139,"resourceType":140,"resourceTypeDesc":141,"sizeBytes":142,"sourceHtmlUrl":143},"scripts\u002Fagent.py","SCRIPT","脚本",6952,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002Fscripts\u002Fagent.py",{"path":145,"resourceType":140,"resourceTypeDesc":141,"sizeBytes":146,"sourceHtmlUrl":147},"scripts\u002Fprocess.py",6007,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-fuzz-testing-in-cicd-with-aflplusplus\u002Fscripts\u002Fprocess.py",[149,170,194,219,245,272],{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":50},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[155],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[157,158,159,160,48,46,161,162,44,43,163,34,164,41,165,39,166,167,168,169],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","supply-chain","supply-chain-security","attestation","code-signing","cosign","keyless",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":50},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[176],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[178,166,179,180,48,181,46,44,182,183,184,185,186,187,188,189,190,191,192,193],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":202,"publishedAt":50},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[200,201],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[188,203,204,205,33,46,206,207,182,208,209,210,211,212,213,214,215,216,217,218],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":226,"publishedAt":50},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[225],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[227,228,229,46,230,231,232,233,234,235,236,237,238,239,240,241,185,242,243,244],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":246,"name":247,"nameZh":6,"description":248,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":249,"categories":250,"keywords":252,"publishedAt":50},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[251],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[253,254,255,46,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":273,"name":274,"nameZh":6,"description":275,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":276,"categories":277,"keywords":279,"publishedAt":50},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[278],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[48,280,46,281,282,283,284,285,286,287,288,214,289,215,290,291,292,293,294,295],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]