ClawHub
Back to skill

Security audit

rust-review

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a legitimate Rust review checklist, but it asks the agent to install and run an unpinned external testing tool across a workspace without enough safety limits.

Review the skill before installing and do not allow it to automatically run cargo install cargo-mutants. If mutation testing is needed, pin and review an exact cargo-mutants version, use --locked where applicable, verify the registry, and run it in a sandbox with minimal secrets and filesystem access. Also be aware that broad triggers may load this skill during general Rust conversations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
modules/test-slop.md:269
Finding

Unpinned Third-Party Executable Installation

Content
View full analysis

Vulnerability Details

File Location: modules/test-slop.md:269-271
Vulnerability Type: Unpinned third-party dependency installation and execution
Risk Level: Medium

Vulnerable Code:

bash
cargo install cargo-mutants
cargo mutants --workspace

Technical Analysis

The Skill recommends installing cargo-mutants without specifying an exact version or requiring Cargo's locked dependency resolution. As a result, cargo install resolves the package and its transitive dependencies at execution time rather than using a dependency set reviewed alongside this Skill.

Cargo may compile and execute package build scripts and procedural macros during installation. The resulting binary is then executed against the workspace. If the package, a transitive dependency, or the configured Cargo registry is compromised, following these instructions could execute code that was not present during this audit.

This is a supply-chain weakness rather than evidence that cargo-mutants is currently malicious.

Attack Path

  1. An attacker compromises a future cargo-mutants release, one of its resolved transitive dependencies, or the Cargo registry configured on the target system.
  2. A user or agent follows the Skill's cargo install cargo-mutants instruction.
  3. Cargo retrieves the currently resolved package and dependencies without enforcing a reviewed exact version or the published lockfile.
  4. Attacker-controlled build-time code may execute during compilation.
  5. The newly installed cargo mutants --workspace executable runs with the invoking user's permissions and receives access to the target workspace.
  6. Malicious code could read or modify files and access other resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running Cargo. The accessible scope may include the audited workspace, user-readable files ...[truncated 200 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin an exact, reviewed release and honor its lockfile:

    bash
    cargo install cargo-mutants --version '<exact-reviewed-version>' --locked
cargo mutants --workspace

  • Verify that the package is obtained from the expected crates.io registry rather than an untrusted registry override.

  • Review the pinned package, transitive dependencies, build scripts, and procedural macros before approving installation.

  • Prefer a project-controlled CI or container image containing a previously reviewed cargo-mutants binary and toolchain.

  • Run mutation testing in a sandbox with minimal filesystem, credential, environment-variable, and network access.

  • Record and periodically reassess the approved version instead of automatically consuming the latest available release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill’s declared purpose is Rust security review, but the body is a generic test-quality/slop detector. That scope mismatch is dangerous because it can cause the agent to spend review effort on stylistic or quality issues while missing unsafe code, dependency risk, ownership bugs, or other security-relevant checks users expected from this skill. In an automated pipeline, this becomes a security coverage failure rather than just a documentation issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list contains broad single-word activators like 'rust', 'ownership', 'unsafe', 'traits', and 'cargo' that are likely to appear in ordinary discussion, making unintentional activation plausible. In an agent setting, this can cause the skill to load or influence behavior outside explicit user intent, increasing prompt-scope expansion and the chance that adversarial repository content steers the review workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description 'Audits Rust code for unsafe blocks, ownership issues, and Cargo dependency risks' describes purpose but does not define clear activation boundaries, so a routing system may infer applicability too broadly from any Rust-related context. That ambiguity is especially risky here because the skill instructs loading additional modules and performing review steps, which could expand the agent's operational context without an explicit user request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for auditing Rust code for unsafe blocks, ownership issues, and Cargo dependency risks, but this file implements guidance for idiomatic iterator usage, allocation avoidance, and performance/style cleanup. While there is some overlap with ownership-related borrowing advice, the module’s dominant behavior is broader code-style and micro-optimization review outside the declared scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Patterns such as bool-match simplification, fixed-size array vs Vec choices, dyn-dispatch hot-loop tuning, and collect-then-iterate are general idiom/performance checks rather than audits of unsafe code, ownership correctness, or dependency risk. These capabilities expand the skill into a broad Rust style/performance reviewer without that scope being declared in the manifest.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · modules/test-slop.md (reported line 208)May include surrounding context.

// SLOP #[test] fn test_api_call() { let resp = reqwest::blocking::get("https://api.example.com/data").unwrap(); // real network call; flaky, slow, leaks }

text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module recommends installing and running cargo-mutants, which expands capability from passive review into tool installation and code execution. In an agent setting, encouraging package installation and workspace-wide execution can create unnecessary supply-chain and execution risk, especially when that behavior is not justified by the manifest’s stated security-audit scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This is a markdown file, so vague-trigger review applies. The description and heading describe the skill's purpose broadly ('Unsafe block auditing, FFI contracts, and safety invariants' / 'Unsafe & FFI Audit') but do not specify concrete trigger phrases, scope boundaries, or exclusion conditions, which can make invocation conditions ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The output template mandates fixed English section headings like 'Unsafe Audit', 'Summary', and English field labels. This can violate language/locale policy if the broader system expects user-language responses and no opt-in or justification for English-only output is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.