Security audit
Security checks for vulnerabilities and agentic risk
This is a Rust best-practices reference skill with a broad Rust trigger, but I found no hidden execution, persistence, credential access, or data-exfiltration behavior.
Installers should be aware that this skill may load often in conversations that merely mention Rust-related terms, increasing context use. Otherwise, it appears to be normal Rust engineering guidance; still review any generated cargo commands or dependency changes before allowing an agent to run or apply them.
The skill is configured to trigger on a very broad set of common Rust-related terms and instructs the agent to always load it proactively. This can cause unnecessary invocation in loosely related contexts, increasing prompt surface area, consuming context budget, and making the agent more susceptible to instruction precedence or indirect prompt-injection effects from unneeded skill content.
Referenced artifact was not completely inspected
property-based testing (`proptest`/`quickcheck`), fuzzing, doctest, coverage | `references/08-testing-and-quality.md` |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- [ ] Hand-rolled `std::env::args()` parsing instead of `clap` for anything beyond a single flag
- [ ] Errors/diagnostics printed to `stdout` instead of `stderr`, breaking pipeline composability
- [ ] ANSI color codes emitted unconditionally without checking TTY/`NO_COLOR`
- [ ] `process::Command` output/exit status never checked
- [ ] Hardcoded `/`-separated paths instead of `Path`/`PathBuf`
- [ ] Program always exits 0 regardless of actual success/failure
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- [ ] Hand-rolled `std::env::args()` parsing instead of `clap` for anything beyond a single flag
- [ ] Errors/diagnostics printed to `stdout` instead of `stderr`, breaking pipeline composability
- [ ] ANSI color codes emitted unconditionally without checking TTY/`NO_COLOR`
- [ ] `process::Command` output/exit status never checked
- [ ] Hardcoded `/`-separated paths instead of `Path`/`PathBuf`
- [ ] Program always exits 0 regardless of actual success/failure
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- [ ] Hand-rolled `std::env::args()` parsing instead of `clap` for anything beyond a single flag
- [ ] Errors/diagnostics printed to `stdout` instead of `stderr`, breaking pipeline composability
- [ ] ANSI color codes emitted unconditionally without checking TTY/`NO_COLOR`
- [ ] `process::Command` output/exit status never checked
- [ ] Hardcoded `/`-separated paths instead of `Path`/`PathBuf`
- [ ] Program always exits 0 regardless of actual success/failure
No suspicious patterns detected.