Rust Best Practices

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:34 AM UTC
• Version: 1.0.3

Overview

This is a Rust coding-guidance skill with ordinary developer commands and no evidence of hidden or malicious behavior.

Install only if you want Rust development guidance. Before following commands that install tools or modify a project, review them, avoid elevated privileges, and consider pinning cargo-installed tool versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/performance.md:31

Finding

Unpinned Installation of Executable Cargo Packages

Content

View full analysis

Vulnerability Details

File Location: references/performance.md, lines 31 and 46
Vulnerability Type: Unpinned third-party executable dependencies
Risk Level: Medium

Vulnerable Code

At line 31:

shell

cargo install flamegraph

At line 46:

shell

cargo install samply

Technical Analysis

The profiling guidance installs executable third-party Cargo packages without specifying reviewed versions or requiring their locked dependency graphs. Consequently, Cargo resolves the package versions and transitive dependencies available from the registry at installation time.

This creates a supply-chain trust boundary outside the audited project. The effective code installed by these commands can change after this Skill has been reviewed. Cargo package installation may also compile dependencies, build scripts, and procedural macros locally. If a package release, maintainer account, or transitive dependency is compromised, attacker-controlled code could run with the privileges of the user executing Cargo.

The package names and their profiling purpose appear legitimate, and the audit found no evidence that the Skill intentionally references malicious packages. The vulnerability is the unsafe, non-reproducible installation method rather than a confirmed compromise of either package.

Attack Path

1. An Agent or developer follows the profiling instructions.
2. The Agent executes cargo install flamegraph or cargo install samply.
3. Cargo retrieves the package and its dependency graph as resolved at execution time.
4. A compromised package release or transitive dependency supplies malicious build-time or runtime code.
5. Cargo compiles the package locally, potentially executing malicious build scripts or procedural macros.
6. The installed executable may execute further attacker-controlled behavior when invoked.

Impact Assessment

Malicious package code would normally execute with the permissions of the user running Cargo. Depen ...[truncated 537 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each tool to a specifically reviewed version:

   shell

   cargo install flamegraph --version <reviewed-version> --locked
   cargo install samply --version <reviewed-version> --locked
   

2. Record the approved versions in the Skill and review them before updates.

3. Retain --locked so installation uses the package's published lockfile when available, reducing unreviewed transitive dependency drift.

4. Explicitly document crates.io as the expected registry source and avoid alternate registries, Git dependencies, or local source overrides unless separately reviewed.

5. In managed development and CI environments, prefer pre-approved tools supplied through a pinned toolchain image or an internally verified artifact repository.

6. Verify package provenance, checksums, maintainer status, security advisories, and dependency changes as part of each version update.

7. Avoid running installation commands with elevated privileges and isolate compilation in a least-privileged development or CI environment.

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

encode invariants in types; watch hidden contracts (re-exports, auto-traits) | [references/api-design.md](references/api-design.md) |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

encode invariants in types; watch hidden contracts (re-exports, auto-traits) | [references/api-design.md](references/api-design.md) |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

encode invariants in types; watch hidden contracts (re-exports, auto-traits) | [references/api-design.md](references/api-design.md) |

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

or single-owner heap allocation, `Rc<T>`/`Arc<T>` for shared ownership, `Cell`/`RefCell`/`Mutex`/`RwLock` for interior mutability. Use `LazyLock`/`LazyCell` (stable since 1.80) instead of `lazy_static` or `once_cell`. See [references/pointer-types.md](references/pointer-types.md) for the full single-thread vs multi-thread decision table and migration guidance.

## Destructors and Cleanup

`Drop::drop(&mut self)` cannot return an error or `.await`. For fallible cleanup (I/O flush, network shutdown, async commit), expose an explicit `close()` or `shutdown()` method returning `Result<(), Error>` (or `impl Future`) and run best-effort cleanup in `Drop` as a fallback. Patterns for "consume self in Drop": `Option<T>`-newtype with `mem::take`, per-field `mem::take`, or `ManuallyDrop<T>`. Never `block_on(...)` in `Drop` (deadlock under async runtimes). For scoped state changes (toggle, restore, run on panic), use a **drop guard** bound with `let _guard = ...` — never `let _ = ...`, which dro

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/api-design.md (reported line 263)May include surrounding context.

t Borrow as "equivalent for collection keys," not as a general "I can be referenced as." AsRef is the right trait for cheap reference-to-reference conversions without the hash/eq invariant. Deref is for transparent dot-operator forwarding.

For a transparent wrapper, eagerly provide all of: Deref, AsRef<Inner>, From<Inner>, Into<Inner>.

Fallible and Blocking Destructors

Drop::drop(&mut self) cannot return an error and cannot .await. For I/O-flavored types this is a real design constraint. Patterns:

Explicit close() / shutdown() method taking self by value and returning Result<(), Error> (or impl Future<Output = Result<...>>). Drop runs as best-effort fallback only. Document the explicit destructor prominently — users won't find it by reading method signatures.

rust

impl Connection {
    pub fn close(self) -> Result<(), CloseError> { /* surfaces errors */ }
}
impl Drop for Connection {
    fn drop(&mut self) { let _ = self.try_close_sync();

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/coding-idioms.md (reported line 285)May include surrounding context.

ds

RAII bound to a scoped local lets you restore state, release a flag, or run cleanup at scope exit, including on panic. The pattern is a small struct that implements Drop; the side effect lives in the destructor.

rust

fn with_flag(flag: &AtomicBool, f: impl FnOnce()) {
    flag.store(true, Ordering::Release);
    struct Guard<'a>(&'a AtomicBool);
    impl Drop for Guard<'_> {
        fn drop(&mut self) { self.0.store(false, Ordering::Release); }
    }
    let _guard = Guard(flag); // bound to a name; lives until scope ends
    f();
}

The bug that catches everyone: let _ = Guard(flag) is NOT the same as let _guard = Guard(flag). The bare _ pattern is a wildcard, not a binding — the temporary is dropped immediately at the ;, before f() runs. A leading-underscore name (_guard) is a real binding and extends the lifetime to the end of the enclosing block.

rust

let _ = Guard(flag);      // BAD: Drop runs here, before f()
f();
let _guard = Guard(flag); // GOOD:

Static analysis

No suspicious patterns detected.