cargo-fuzz
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs standard Rust development and security tools (
cargo-fuzz,cargo-geiger,cargo-binutils,rustfilt) viacargo installand manages toolchains usingrustup. It also includes a command to fetch a sample Ogg file from Wikimedia Commons to seed an example fuzzing corpus. - [COMMAND_EXECUTION]: Provides instructions for initializing fuzzing environments, compiling harnesses with the nightly Rust compiler, and executing fuzzing campaigns using the
cargo fuzzsubcommand. - [DYNAMIC_EXECUTION]: The skill includes a documentation pattern that generates a local helper script (
generate_html) via a shell redirect. This script is used to invoke standard LLVM coverage tools to generate human-readable HTML reports from fuzzing results. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (fuzzing corpus) at
fuzz/corpus/. This is the intended purpose of the fuzzer (libFuzzer), and the processing is contained within the fuzzer's execution environment without impacting the agent's safety guardrails.
Audit Metadata