Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Rust code-review skill that inspects local project context and runs normal Rust review tooling, with no hidden install, persistence, or exfiltration behavior found.
Install this for Rust projects you are comfortable allowing an agent to inspect and build. Before using it on third-party or untrusted code, remember that cargo checks, clippy, and tests may execute code from that repository, and verify any sibling review skills it loads are ones you trust.
Referenced artifact was not completely inspected
Load each applicable skill below (e.g. load the [rust-code-review](../rust-code-review/SKILL.md) skill) by reading its `SKILL.md` and applying it.
The skill directs the agent to execute numerous shell and VCS commands (git diff, grep, cargo, ls) against the local workspace. Even though these are framed as review steps, they expand the skill from passive analysis into active command execution, which can expose repository metadata, enumerate files outside the immediate review target, and trigger tool behavior in an untrusted project context.
The arguments section says sequential execution yields identical output when subagents are unavailable, but the implementation requires loading several sibling skills and protocol documents to function. This introduces a dependency-management capability beyond simple Rust review and may not be justified by the narrow manifest description of reviewing .rs files.
The manifest says the skill is for review of .rs files, yet the documented behavior explicitly examines Cargo.toml, workspace configuration, dependencies, benches/, and other non-.rs project metadata to route review logic. Some project-context inspection is reasonable, but the actual scope is broader than the stated '.rs files' review description.
No suspicious patterns detected.