fuzz
Fuzz React Doctor rules for crashes, slowness, false positives, and mutation-sensitive diagnostics with @react-doctor/fuzz. Use after rule tests pass, when investigating a fuzz finding, or whenever an eval, review, or user report confirms a new false positive.
- Installs
- 283
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/millionco/react-doctor --skill fuzz- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads fuzz automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Fuzz rules
Use packages/fuzz after focused rule tests pass. Read its README.md for harness architecture and corpus setup.
Run the harness
Run the target rule first:
FUZZ_RULE=<rule-id> FUZZ_STRICT=1 FUZZ_ITERATIONS=500 nr fuzz
Useful variants:
nr fuzz
FUZZ_RULE=<rule-id> FUZZ_SEED=42 nr fuzz
FUZZ_INVARIANTS=1 nr fuzz
FUZZ_CORPUS_DIR=<repository-directory> nr fuzz
FUZZ_RULE=<rule-id> FUZZ_PRINT_SILENT=1 nr fuzz
Confirm that the target rule fires. A silent rule only exercises early exits. If it stays silent, add a triggering shape to packages/fuzz/src/snippet-pools.ts and rerun.
Use FUZZ_TAG=<tag> instead of FUZZ_RULE to exercise an entire registry cohort.
Recommended full sweep (e.g. before a rule-batch release), pointing the
corpus at real checkouts. Ready-made corpora work on any machine — see the
package README "Canonical corpora": bun scripts/sync-fuzz-corpus.ts
materializes a pinned 48-repo sample (symlinking the RDE cache when
present, cloning otherwise), and bun scripts/build-bench-corpus.ts
extracts react-bench's diagnostic-dense RD-health target files:
cd packages/fuzz
bun scripts/sync-fuzz-corpus.ts
FUZZ_INVARIANTS=1 FUZZ_ITERATIONS=100 FUZZ_CORPUS_DIR=tmp/corpus-repos nr fuzz
Run the direct false-positive check when a rule change affects common syntax:
cd packages/fuzz
bun scripts/hunt-false-positives.ts
Triage findings
Reproducers live in packages/fuzz/tmp/fuzz-findings/.
- Crash: minimize the program, add a no-throw regression test, fix the rule, and replay the seed
- Slow case: profile the pathological shape, bound the walk, and keep the existing threshold
- Verdict drop: fix detection that depends on incidental syntax, then add the rule to the robustness gate when appropriate
- Invariant violation: decide whether the rule should react to the rewrite; fix and test unexpected changes
- False positive: add the valid program to the rule tests and fuzz regression corpus
Replay one finding:
FUZZ_RULE=<rule-id> FUZZ_SEED=<seed> FUZZ_ITERATIONS=1 nr fuzz
Preserve false positives
For every confirmed false positive:
- Add a minimal fixture to
packages/fuzz/corpus/regressions/<rule-id>--<slug>.tsx. - Include the rule ID, weakness class, and source in the fixture header.
- Add a focused valid case to the rule test suite.
- Add a generator snippet when the existing pools cannot produce the weakness.
- Run
nr -C packages/fuzz testand replay the target rule.
Use a stable weakness name such as library-idiom, control-flow, wrapper-transparency, name-heuristic, alias-guard, cross-file, framework-gating, paren-shape, default-parameter, dynamic-computed, private-member, or copy-tracking.
Project-level dead-code and dependency findings belong in core tests, not the rule fuzzer.
Report results
Record the command, target-rule fire count, findings, replay seeds, corpus fixtures, and generator changes. Pass confirmed implementation findings to rule-validate.
FAQ
What does the fuzz skill do?
Fuzz React Doctor rules for crashes, slowness, false positives, and mutation-sensitive diagnostics with @react-doctor/fuzz. Use after rule tests pass, when investigating a fuzz finding, or whenever an eval, review, or user report confirms a new false positive.
How do I install fuzz?
Run npx skills add https://github.com/millionco/react-doctor --skill fuzz in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/fuzz/ (personal) or .claude/skills/fuzz/ (project).
Which AI agents can use fuzz?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is fuzz safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains fuzz?
It is published by millionco in millionco/react-doctor. It has 283 recorded installs.
More from millionco/react-doctor
react-doctor
millionco/react-doctor
Use when finishing a feature, fixing a bug, before committing React code, or when the user types /doctor, asks to scan, triage, or clean up React diagnostics. Covers lint, accessibility, bundle size, architecture. Includes a regression check and a full local-triage workflow that fetches the canonical playbook.
improve-react
millionco/react-doctor
Survey a whole React codebase as a senior React engineer, using React Doctor's scan as evidence, then produce a prioritized audit and self-contained implementation plans for other agents (or cheaper models) to execute. Read-only on source code — it plans improvements, it does not apply them. Use when the user asks to "improve the React code", "audit this codebase", "make this app faster / more robust", or wants a roadmap of fixes rather than a review of a single diff. For a regression check or a fix-it-now pass, use the react-doctor skill instead.
deslop
millionco/react-doctor
Simplify and refine recently modified code while preserving functionality. Use when asked to "deslop", "clean up code", "simplify code", or after making changes that could benefit from refinement.
find-similar-functions
millionco/react-doctor
Use truffler to find similar or pre-existing JavaScript/TypeScript symbols before implementing new code, especially helpers, utilities, parsers, formatters, scanners, fuzzy matchers, and other reusable functions. Agents should use this skill whenever they are about to add or refactor functionality in a JS/TS repository and need to avoid duplicating existing code, even if the user does not explicitly mention deduplication.
rule-writing
millionco/react-doctor
Implement React Doctor rules from a validated contract. Use when writing oxlint rules, planning syntax or control-flow detection, designing adversarial tests, reusing syntax tree utilities, or updating rule registration.
rule-validate
millionco/react-doctor
Open the skill to read its SKILL.md instructions.
Popular frontend & design skills
setup-matt-pocock-skills
mattpocock/skills
Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.
frontend-design
anthropics/skills
Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
hyperframes-animation
heygen-com/hyperframes
All animation knowledge for HyperFrames — atomic motion rules, multi-phase scene blueprints, scene transitions, broader motion-design techniques, AND the seven runtime adapters (GSAP default, plus Lottie, Three.js, Anime.js, CSS keyframes, Web Animations API, TypeGPU). Use for any motion or animation task: pick 2-4 rules and compose, or load a blueprint, or look up runtime-specific API (e.g. GSAP eases / Lottie player / Three.js mixer). Also covers auditing an existing composition's choreography (animation map) and 24 named text-animation effects. HyperFrames-native: single paused timeline, seek-safe, deterministic.
prototype
mattpocock/skills
Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.
hyperframes-core
heygen-com/hyperframes
The HyperFrames composition contract — build one renderable project. Use for composition structure, the data- timing attributes, class="clip", tracks, sub-compositions, variables, framework-owned media playback, deterministic-render rules, and validation. Read before writing composition HTML.
vercel-react-best-practices
vercel-labs/agent-skills
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.