ruzzy — Claude Code skill: fuzz Ruby and its C extensions
This skill installs and runs Ruzzy, a coverage-guided Ruby fuzzer built on libFuzzer. Reach for it when a gem needs crash hunting or a native extension needs a memory-safety check.
npx skills add trailofbits/skills --skill ruzzy -a claude-codeWhat ruzzy does
Ruzzy brings coverage-guided fuzzing to Ruby on top of libFuzzer. The skill walks through installation, harness setup and a fuzzing campaign against either plain Ruby code or the native C extensions shipped inside gems. Linux x86-64 and AArch64/ARM64 are supported; macOS and Windows users go through the Dockerfile or the development environment in the repository.
Plain Ruby needs two scripts. A tracer calls Ruzzy.trace('test_harness.rb'), and the harness itself defines a test_one_input lambda that returns 0 and hands control to Ruzzy.fuzz. C extensions skip the tracer and run from a single file — wrap the call in a rescue so Ruby exceptions don't kill the fuzzer, since the target is memory corruption, not ordinary errors. Keep the harness deterministic; randomness or time-based logic breaks it.
Set ASAN_OPTIONS with allocator_may_return_null=1, detect_leaks=0 and use_sigaltstack=0 before a campaign. LD_PRELOAD points at the ASan path and belongs on the command line rather than in an exported variable, otherwise it can leak into other programs. Building gems with sanitizers takes clang plus flags such as -fsanitize=address,fuzzer-no-link. An old clang is where this falls over — check the version first.
What it helps with
- hunt crashes in a pure Ruby library with coverage guidance
- check a gem's C extension for memory corruption
- compile a gem with AddressSanitizer and instrumentation flags
- replay a saved crash input after a campaign
- run libFuzzer with a corpus and custom limits
Example prompts for the agent
- Set up Ruzzy and write a harness to fuzz my Ruby library
- Build my gem's C extension with sanitizers and start fuzzing
- Help me reproduce the crash in
crash-253420c1158bc6382093d409ce2e9cff5806e980
How to install ruzzy
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill ruzzy -a claude-code2Manually: put the files in place
~/.claude/skills/ruzzy/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/ruzzy/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill ruzzy -a codex2Manually: put the files in place
.agents/skills/ruzzy/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill ruzzy -a cursor2Manually: put the files in place
.cursor/skills/ruzzy/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills ruzzy2Manually: put the files in place
.github/skills/ruzzy/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill ruzzy -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/ruzzyManually: put the files in place
.devin/skills/ruzzy/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill ruzzy -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about ruzzy
How do I install ruzzy in Claude Code?
Run npx skills add trailofbits/skills --skill ruzzy -a claude-code. The skill lands at ~/.claude/skills/ruzzy/SKILL.md.
What does ruzzy do?
It sets up and runs Ruzzy, a coverage-guided Ruby fuzzer built on libFuzzer. The skill covers harness structure for plain Ruby and C extensions, plus sanitizer builds.
What do I need to run Ruzzy?
Linux x86-64 or AArch64/ARM64, a recent clang, and Ruby with gem installed. On macOS or Windows, use the Dockerfile or the development environment from the repository.
