rust-best-practices — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rust-best-practices (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Apply these guidelines when writing or reviewing Rust code. Based on Apollo GraphQL's Rust Best Practices Handbook.
Before reviewing, familiarize yourself with Apollo's Rust best practices. Read ALL relevant chapters in the same turn in parallel. Reference these files when providing feedback:
&T over .clone() unless ownership transfer is required&str over String, &[T] over Vec<T> in function parametersCopy types (≤24 bytes) can be passed by valueCow<'_, T> when ownership is ambiguousResult<T, E> for fallible operations; avoid panic! in productionunwrap()/expect() outside teststhiserror for library errors, anyhow for binaries only? operator over match chains for error propagation--release flagcargo clippy -- -D clippy::perf for performance hints.iter() instead of .into_iter() for Copy types.collect() callsRun regularly: cargo clippy --all-targets --all-features --locked -- -D warnings
Key lints to watch:
redundant_clone - unnecessary cloninglarge_enum_variant - oversized variants (consider boxing)needless_collect - premature collectionUse #[expect(clippy::lint)] over #[allow(...)] with justification comment.
process_should_return_error_when_input_empty()///) for public API examplescargo insta for snapshot testing generated outputdyn Trait only when heterogeneous collections are neededEncode valid states in the type system to catch invalid operations at compile time:
struct Connection<State> { /* ... */ _state: PhantomData<State> }
struct Disconnected;
struct Connected;
impl Connection<Connected> {
fn send(&self, data: &[u8]) { /* only connected can send */ }
}// comments explain why (safety, workarounds, design rationale)/// doc comments explain what and how for public APIsTODO needs a linked issue: // TODO(#42): ...#![deny(missing_docs)] for libraries~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.