ruzzy

An agent skill by trailofbits, from trailofbits/skills. Tags: fuzzing, ruby, security, testing.

What it does

Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C extensions in gems, and sanitizer builds. Use when fuzzing a Ruby library or gem, testing a Ruby C extension for memory safety, or asking how to fuzz Ruby at all.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill ruzzy

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/ruzzy ~/.claude/skills/ruzzy

Safety box score

Grade B, low risk: 25 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation-only fuzzing guide for Ruby apps and native extensions, centered on installing the `ruzzy` gem and running Ruby/libFuzzer commands with sanitizers. The main risks are local code execution during setup and fuzzing, network downloads for gem installation, and process-environment changes via `LD_PRELOAD` while crash artifacts are written locally.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the user to run shell and Ruby commands such as `gem install ruzzy` and `ruby -e 'require "ruzzy"'`, which execute code on the local machine as part of setup and fuzzing.
Network access	1 (low)	Normal use fetches packages and references remote resources, including `gem install ruzzy`, `gem install <gem-name>`, and links to GitHub/libFuzzer docs, but it does not exfiltrate user data.
Filesystem reach	1 (low)	The harness examples read corpora and write crash artifacts in the working directory (`artifact_prefix='./'; Test unit written to ./crash-*`), and gem installation writes into the local Ruby environment.
Secrets & credentials	0 (none)	The skill does not request API keys, passwords, token files, `.env` files, browser sessions, or other credentials.
Privilege & persistence	2 (moderate)	It changes process loading with `LD_PRELOAD=$(ruby -e 'require "ruzzy"; print Ruzzy::ASAN_PATH')` and installs gems into the user's Ruby toolchain, but it does not ask for sudo or persistent system services.
Instruction hijack surface	0 (none)	There are no instructions to ignore higher-priority rules, hide behavior, or follow fetched prompt text; the file content is straightforward documentation.
Irreversible actions	0 (none)	The skill only fuzzes locally and reproduces crashes; it does not publish, send messages, deploy, pay, or make external changes on its own.
Transparency	0 (none)	All shipped files are human-readable Markdown, YAML, and SVG; there are no binaries, encoded blobs, or downloaded installers.

Before installing

Read `SKILL.md`'s install commands and confirm whether `gem install` will write to your user gem directory or a system-wide Ruby path.
Try the workflow in a scratch Ruby environment first, with no secrets loaded, because the guide uses `ruby -e ...` and `LD_PRELOAD`.
Check where crash files and corpora will live before fuzzing; the examples write artifacts to `./crash-*` in the current directory.

Rated 2026-10-20 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/ruzzy/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.
fuzzing-obstacles — Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds.
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
aflpp — Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast.
cargo-fuzz — Sets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target!
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.