feat(scripts): generic oss-fuzz task script + run-oss-fuzz-task skill

[ret2libc]

What

Two additive dev-workflow helpers for spinning up Buttercup locally and testing it against an OSS-Fuzz project.

scripts/task_oss_fuzz.sh

A generic, flag-driven replacement for the per-project orchestrator/scripts/task_upstream_*.sh scripts. POSTs to the CRS webhook (/webhook/trigger_task) for any OSS-Fuzz project.

• Defaults the fuzzing tooling to upstream google/oss-fuzz @ master — only --project is required.
• Supports full mode, delta mode (--base-ref ⇒ requires --repo-url + --head-ref), custom --duration, custom oss-fuzz fork/ref, and --api-url / BUTTERCUP_API_URL.
• --dry-run prints the JSON without submitting.
• Builds the payload with jq when available, with a validated jq-less fallback.
• Payload matches the server's Challenge model exactly; drops the harnesses_included field (not on the model — silently ignored by the older scripts).

./scripts/task_oss_fuzz.sh -p libpng -r https://github.com/pnggroup/libpng -b libpng16
./scripts/task_oss_fuzz.sh -p libucl                 # minimal
./scripts/task_oss_fuzz.sh -p libpng ... --dry-run   # preview payload

.claude/skills/run-oss-fuzz-task/

A Claude Code skill that runs the end-to-end local smoke test:

1. ensures dev/docker-compose/.env exists (from the template) and warns on placeholder LLM keys;
2. starts the stack with docker compose — prebuilt GHCR images by default, build-local on request;
3. waits for the buttercup-ui webhook on 127.0.0.1:31323;
4. submits the task via scripts/task_oss_fuzz.sh;
5. reports log-follow / dashboard / teardown commands.

Notes

• No changes to existing code or services — purely additive (one script + one skill).
• The script's default endpoint matches the compose port mapping, so no kubectl port-forward is needed for the compose flow.

Testing

• bash -n + --dry-run across full / minimal / delta modes; delta-mode arg validation; jq-less fallback emits valid JSON.
• docker compose config validates from the repo root for both prebuilt-overlay and build-local invocations; prebuilt overlay publishes the UI on 31323.

🤖 Generated with Claude Code