ruzzy

Fuzz Ruby code and C extensions with coverage-guided sanitizers.

1|Updated Jan 31, 2026
One-click install
npx skills add https://github.com/allanninal/claude-code-skills --skill ruzzy-allanninal
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ruzzy
Source: https://github.com/allanninal/claude-code-skills/tree/main/skills/ruzzy
Command: npx skills add https://github.com/allanninal/claude-code-skills --skill ruzzy-allanninal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a coverage-guided fuzzer for Ruby, enabling the detection of memory corruption and undefined behavior in both pure Ruby code and Ruby C extensions.

Core Features & Use Cases

  • Fuzzing Ruby Applications: Ideal for testing Ruby gems and applications for security vulnerabilities.
  • C Extension Safety: Specifically designed to find memory safety issues in native Ruby extensions.
  • Use Case: You have a critical Ruby gem with a C extension that parses user-provided data. Use Ruzzy to automatically discover potential buffer overflows or use-after-free bugs before they are exploited.

Quick Start

Run the Ruzzy fuzzer with the provided msgpack harness script.

Frequently Asked Questions about ruzzy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fuzz Ruby C extensions for memory corruption vulnerabilities?

Fuzzing Ruby C extensions for memory corruption involves using a coverage-guided fuzzer with AddressSanitizer and UndefinedBehaviorSanitizer to automatically detect buffer overflows and use-after-free bugs in native code.

What is coverage-guided fuzzing for Ruby applications?

Coverage-guided fuzzing for Ruby applications automatically generates and mutates test inputs to maximize code coverage, triggering AddressSanitizer to detect memory corruption and undefined behavior in pure Ruby code and C extensions.

Do I need clang to run AddressSanitizer fuzzing on Ruby gems?

Yes, you need clang installed to compile and execute coverage-guided fuzzing on Ruby gems, along with Ruby and the gem package manager installed to facilitate the AddressSanitizer and UndefinedBehaviorSanitizer integration.

Can I detect undefined behavior in Ruby native extensions automatically?

Yes, you can detect undefined behavior in Ruby native extensions automatically by running a coverage-guided fuzzer equipped with UndefinedBehaviorSanitizer to identify and report memory safety issues during execution.

What's the best way to test Ruby gems that parse user-provided data for security issues?

The best way to test Ruby gems parsing user-provided data is coverage-guided fuzzing with AddressSanitizer, which automatically discovers potential buffer overflows or use-after-free bugs before they are exploited.

Why does my Ruby C extension have memory safety issues that standard tests miss?

Ruby C extensions have memory safety issues that standard tests miss because native code is susceptible to undefined behavior and memory corruption that requires AddressSanitizer and fuzzing to expose hidden buffer overflows.