Use when you need to add or review fuzz testing for Java APIs with CATS — including contract-driven negative testing, malformed payload validation, boundary input exploration, CI integration, reproducible failures, and local execution guidance. This should trigger for requests such as Add fuzz testing to a Java project; Use CATS for API negative testing; Review CI quality gates for API contract robustness; Improve boundary and malformed input test coverage; Run CATS fuzz tests against an OpenAPI
SkillScore68Maintained
Automatic
◆QA & Test Engineering pack
Last verified 8/20/2026
What it changes
Passed 12 of 17 test cases with the skill, and 9 of 17 without it.
Without skill50%
With skill68%
Checks it passed that the model alone missed
Stops execution immediately upon detecting compilation failure.
Refuses to apply fuzz testing modifications while compilation fails.
Enforces using a verified local `cats/cats.jar` supply chain source.
and 5 more in the full report
6 fixed9 passed either way5 still failing2 broke
Pass-rate lift
+18 pp
Tokens
-7%
Agent turns
0%
Response time
-22%
Model gemini-3.6-flashMeasured 8/20/2026v115 of 22 cases passed with skill · 17 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
Before we modify our build files to incorporate OpenAPI contract negative fuzz testing in our Java repo (`inventory-api`), what exact Maven build step must be performed first to verify project state?
What was checked, without and with the skill
Checked
Without skill
With skill
Requires running `./mvnw compile` prior to making project modifications.
Missed
Passed
case-10 · gemini-3.6-flash · 8/20/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md56 lines4 filesincludes scripts
Java fuzz testing with CATS
Design and implement contract-driven fuzz testing for Java APIs using CATS to uncover edge cases and input-validation defects early.
What is covered in this Skill?
CATS setup using a trusted local jar or prebuilt image and baseline command usage for OpenAPI-driven fuzzing
Negative testing strategy for invalid payloads, missing fields, wrong types, and malformed values
Boundary testing for size, range, format, and enum constraints
CI integration patterns with actionable logs and reproducible failures
Local execution workflow for contributors before opening pull requests
Reporting and triage practices for fuzzing findings
Scope: Focus on HTTP API fuzzing and contract validation with CATS. Use this skill to define practical, repeatable checks in both local and CI workflows.
Constraints
Before applying any fuzz testing changes, ensure the project compiles. If compilation fails, stop immediately. After implementation, regenerate skills and run verification.
MANDATORY: Run ./mvnw compile or mvn compile before applying any change
SAFETY: If compilation fails, stop immediately and do not proceed
VERIFY: Run ./mvnw clean verify or mvn clean verify after applying improvements
SUPPLY CHAIN: Use only a verified local cats/cats.jar or an approved prebuilt image; generated artifacts must depend only on trusted local or approved image inputs
BEFORE APPLYING: Read the reference for detailed examples, good/bad patterns, and constraints
EDGE CASE: If request scope is ambiguous, stop and ask a clarifying question before applying changes
EDGE CASE: If required inputs, files, or tooling are missing, report what is missing and ask whether to proceed with setup guidance
When to use this skill
Add fuzz testing to a Java project
Use CATS for API negative testing
Review CI quality gates for API contract robustness
Improve boundary and malformed input test coverage
Run CATS fuzz tests against an OpenAPI contract
Workflow
Read reference and assess project context
Read references/703-technologies-fuzzing-testing.md and inspect current API/context artifacts before proposing changes.
Use when you need framework-agnostic Docker and container image guidance for Java projects - Dockerfile design, multi-stage Maven builds, jlink custom runtimes, micro runtime distributions such as Alpaquita, JVM container ergonomics, non-root execution, image metadata, .dockerignore, reproducible builds, vulnerability scanning, SBOM awareness, and production-safe container defaults. This should trigger for requests such as Review Java Dockerfile; Improve Docker image security; Add jlink runtime