ruzzy

npx skills add trailofbits/skills --skill ruzzy --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

# Ruzzy Ruzzy is a coverage-guided fuzzer for Ruby built on libFuzzer. It enables fuzzing both pure Ruby code and Ruby C extensions with sanitizer support for detecting memory corruption and undefined behavior. ## When to Use Ruzzy is currently the only production-ready coverage-guided fuzzer for Ruby. **Choose Ruzzy when:** - Fuzzing Ruby applications or libraries - Testing Ruby C extensions for memory safety issues - You need coverage-guided fuzzing for Ruby code - Working with Ruby gems that have native extensions ## Quick Start Set up environment: ```bash export ASAN_OPTIONS="allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0" ``` Test with the included toy example: ```bash LD_PRELOAD=$(ruby -e 'require "ruzzy"; print Ruzzy::ASAN_PATH') \ ruby -e 'require "ruzzy"; Ruzzy.dummy' ``` This should quickly find a crash demonstrating that Ruzzy is working correctly. ## Installation ### Platform Support Ruzzy supports Linux x86-64 and AArch64/ARM64. For macOS or Windows, use the [Dockerfile](https://github.com/trailofbits/ruzzy/blob/main/Dockerfile) or [development environment](https://github.com/trailofbits/ruzzy#developing). ### Prerequisites - Linux x86-64 or AArch64/ARM64

export ASAN_OPTIONS="allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0"
ruby -e 'require "ruzzy"; Ruzzy.dummy'
gem install ruzzy
ruby test_tracer.rb
ruby fuzz_msgpack.rb
gem install <gem-name>
ruby harness.rb
ruby harness.rb /path/to/corpus
ruby harness.rb /path/to/corpus -max_len=1024 -timeout=10
ruby harness.rb ./crash-253420c1158bc6382093d409ce2e9cff5806e980