ruzzy SKILL.md skillA
ruzzy from trailofbits/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add trailofbits/skills/ruzzy@git:20260826.3deb39ePins git:20260826.3deb39e in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- trailofbits/skills
- Path
plugins/testing-handbook-skills/skills/ruzzy/SKILL.md- Versions recorded
- 2
- Latest version
- git:20260826.3deb39e, committed Aug 26, 2026
- First version recorded
- Jan 14, 2026
- Size
- 12,164 bytes
- Repository stars
- 8,043
- License
- CC-BY-SA-4.0
Sets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C extensions in gems, and sanitizer builds. Use when fuzzing a Ruby library or gem, testing a Ruby C extension for memory safety, or asking how to fuzz Ruby at all.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Ruzzy
Ruzzy is a coverage-guided fuzzer for Ruby built on libFuzzer. It enables fuzzing both pure Ruby code and Ruby C extensions with sanitizer support for detecting memory corruption and undefined behavior.
## When to Use
Ruzzy is currently the only production-ready coverage-guided fuzzer for Ruby.
**Choose Ruzzy when:**
- Fuzzing Ruby applications or libraries
- Testing Ruby C extensions for memory safety issues
- You need coverage-guided fuzzing for Ruby code
- Working with Ruby gems that have native extensions
## Quick Start
Set up environment:
```bash
export ASAN_OPTIONS="allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0"
```
Test with the included toy example:
```bash
LD_PRELOAD=$(ruby -e 'require "ruzzy"; print Ruzzy::ASAN_PATH') \
ruby -e 'require "ruzzy"; Ruzzy.dummy'
```
This should quickly find a crash demonstrating that Ruzzy is working correctly.
## Installation
### Platform Support
Ruzzy supports Linux x86-64 and AArch64/ARM64. For macOS or Windows, use the [Dockerfile](https://github.com/trailofbits/ruzzy/blob/main/Dockerfile) or [development environment](https://github.com/trailofbits/ruzzy#developing).
### Prerequisites
…Read the whole file at its exact version.
How to install
mdr add trailofbits/skills/ruzzy@sha256:46374463b7ff99b0The line at the top of this page pins the label git:20260826.3deb39e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_uibnb6v3wp2q6o3v)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Jan 14, 2026 and Aug 26, 2026, about one every 224 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260826.3deb39e latest | 2026-08-26 | 3deb39e | 12,164 B | A | view · diff |
| git:20260114.695119c | 2026-01-14 | 695119c | 11,936 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (12164 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
trailofbits/skills · 8,043 stars · license CC-BY-SA-4.0 · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_uibnb6v3wp2q6o3v GET https://markdownregistry.com/api/v1/resolve?ref=trailofbits/skills/ruzzy GET https://markdownregistry.com/api/v1/blob/46374463b7ff99b028692ed8d30f1c9f488597597e5a2af4ad3919e2a47d6ce9
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from trailofbits/skills
Every file in trailofbits/skills