Agent skill · data analytics · jeremylongshore
fuzzing-apis
Configure perform API fuzzing to discover edge cases, crashes, and security
Why this skill is useful
Adds specific commands and strategies for API fuzzing that the AI wouldn't reliably generate on its own.
What it needs
Requires fast-check, restler, schemathesis installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
API Fuzzer Overview Perform API fuzzing to discover crashes, unhandled exceptions, security vulnerabilities, and edge case failures by sending malformed, unexpected, and boundary-value inputs to API endpoints. Supports RESTler (stateful REST API fuzzing), Schemathesis (OpenAPI-driven property-based testing), custom fuzz harnesses with fast-check, and OWASP ZAP active scanning. Prerequisites API specification available (OpenAPI/Swagger, GraphQL SDL, or Protobuf definitions) Target API running in a test environment (never fuzz production) Fuzzing tool installed (Schemathesis, RESTler, or custom harness with fast-check/Hypothesis) API authentication credentials for protected endpoints Error logging enabled on the target server to capture crashes and stack traces Instructions 1. Parse the API specification to identify all endpoints, methods, and input schemas: Read OpenAPI spec files using Glob (/openapi.yaml, /swagger.json). Catalog each endpoint's parameters (path, query, header, body) and their types. Note validation constraints (min/max, pattern, enum, required fields). 2. Configure the fuzzing strategy: Schema-based: Generate inputs that violate schema constraints (wrong types, missing fields, extra fields). Mutation-based: Start with valid requests and mutate individual fields (bit flips, boundary values, special characters). Dictionary-based: Use known problematic inputs (SQL injection, XSS payloads, format strings, null bytes). 3. Define fuzz input categories for each parameter type: Strings: Empty, very long (10K+ chars), unicode, null bytes, format strings (%s%n), path traversal (../../etc/passwd). Numbers: 0, -1, MAXINT, MININT, NaN, Infinity, floats where ints expected. Arrays: Empty, single element, thousands of elements, nested arrays, mixed types. Objects: Empty, missing required fields, extra unknown fields, deeply nested (100+ levels). Dates: Invalid formats, epoch zero, far future, negative timestamps. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/fuzzing-apis--802e4d