ruzzy
Verdict safe, but 8 findings (3 medium, 5 low), mainly data exfiltration, command injection, policy violation. Most recent scan 2026-02-08.
The Ruzzy skill is a legitimate fuzzing tool with moderate security concerns. The primary issues relate to unsafe configuration practices (disabled leak detection, LD_PRELOAD usage without warnings) and potential resource exhaustion from fuzzing operations. The skill does not exhibit malicious behavior such as data exfiltration, credential theft, or prompt injection. However, the instructions could lead to security issues if users follow them without understanding the implications. The missing metadata (license, compatibility, allowed-tools) reduces transparency but does not constitute a direct security threat. This skill should be used only in isolated development/testing environments with appropriate resource limits.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Ruzzy is a coverage-guided Ruby fuzzer by Trail of Bits. Use for fuzzing pure Ruby code and Ruby C extensions.
- Package
- 1 file, 12 KB
- SKILL.md
- 1415 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Ruzzy · When to Use · Quick Start · Installation · Platform Support · Prerequisites · Installation Command · Troubleshooting Installation · Verification · Writing a Harness · Fuzzing Pure Ruby Code · frozen_string_literal: true
Findings
MEDIUM Unsafe Environment Variable Configuration Command Injectionllm
The skill instructs users to set ASAN_OPTIONS with 'detect_leaks=0' which disables leak detection in AddressSanitizer. While this may be necessary for fuzzing operations, it reduces security visibility and could mask memory leaks that might be exploitable.
SKILL.md
export ASAN_OPTIONS="allocator_may_return_null=1:detect_leaks=0:use_sigaltstack=0"MEDIUM LD_PRELOAD Usage Without Security Warnings Command Injectionllm
The skill extensively uses LD_PRELOAD to inject the ASAN library, which is a powerful mechanism that can be abused for privilege escalation or code injection if misused. The instructions do not warn users about the security implications of using LD_PRELOAD.
SKILL.md
LD_PRELOAD=$(ruby -e 'require "ruzzy"; print Ruzzy::ASAN_PATH') ruby test_tracer.rbMEDIUM Fuzzing Operations May Cause Resource Exhaustion Resource Abusellm
The skill enables fuzzing operations which by design generate large amounts of test cases and can consume significant CPU, memory, and disk resources. Without proper resource limits, fuzzing could lead to system instability or denial of service conditions.
SKILL.md
Ruzzy.fuzz(test_one_input) - unbounded fuzzing operationLOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing License Information Data Exfiltrationllm
The skill manifest does not specify a license field. While not a direct security threat, this creates legal ambiguity about usage rights and redistribution, which could expose users to legal risks.
SKILL.md
license: Not specifiedLOW Missing Compatibility Information Data Exfiltrationllm
The skill does not specify compatibility information. Users may attempt to use this skill in unsupported environments, potentially leading to unexpected behavior or security issues.
SKILL.md
compatibility: Not specifiedLOW Missing allowed-tools Declaration Data Exfiltrationllm
The skill does not declare allowed-tools in the manifest. While this field is optional, its absence means users cannot verify which agent tools the skill intends to use, reducing transparency.
SKILL.md
allowed-tools: Not specifiedLOW Referenced Files Not Found Data Exfiltrationllm
The skill references two example files (test_one_input.py, malformed.py) that are not included in the package. While these appear to be documentation examples rather than required files, their absence could confuse users or indicate incomplete packaging.
SKILL.md
Files referenced in instructions: test_one_input.py, malformed.py (not found)What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 12 KB |
External hosts referenced
github.com llvm.org blog.trailofbits.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit a50696e20581. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/trailofbits/skills
- Raw scan result: plugins-testing-handbook-skills-skills-ruzzy-scan.json
- Badge for your README:
- Request a re-scan