rust-expert — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rust-expert (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this as the default Rust engineering router. Inspect the repo first, load only the references needed for the task, then use compiler/test feedback as design evidence.
AGENTS.md, Cargo.toml,Cargo.lock, rust-toolchain.toml, .cargo/config.toml, CI, justfile, mise.toml, and nearby tests.
refactor, dependency, public API, release, performance, or security.
.clone(),Arc<Mutex<_>>, broad trait bounds, unwrap, or unsafe.
scripts/discover-rust-gates.mjs <repo-root>.
upgrades, version-sensitive APIs, Tauri/plugin support, public API/release decisions, security, unsafe/FFI, or novel crates.
Use these implicit specialist skills when the task clearly belongs there:
| Signal | Prefer |
|---|---|
| Command-line app, subcommands, flags, config precedence, JSON/stdout contracts | rust-cli-clap |
| Terminal UI, interactive dashboards, Ratatui widgets/layout/events | rust-tui-ratatui |
Tauri v2, src-tauri, commands, capabilities, IPC, updater, mobile layout | rust-tauri-apps |
| HTTP APIs/services, Axum, Tower, Tokio server runtime, DB pools | rust-web-services |
| Broad architecture review or multi-domain Rust planning explicitly requested | rust-mega-eng |
If no specialist owns the task, stay in rust-expert.
Load the smallest needed set:
references/toolchain-cargo.md: editions, MSRV, resolver, lockfiles, features,workspace policy, verification commands.
references/ownership-async-errors.md: borrow checker, ownership,lifetimes, async Send, task ownership, typed errors.
references/crate-selection.md: preferred crates, dependency decision rules,feature hygiene, source-refresh triggers.
references/testing-quality.md: unit/integration/doctest/property/snapshot/benchmark checks and reviewable test design.
references/performance-security.md: measurement, allocations, unsafe/FFI,supply chain, cargo-deny/audit, secrets and subprocesses.
Existing repos: preserve detected contracts first. Do not change edition, resolver, rust-version, lockfile policy, or exact toolchain pins unless the task is explicitly a migration or the repo is missing required metadata.
Greenfield defaults:
edition = "2024".[workspace] resolver = "3" explicitly for virtual workspaces.rust-version and document the policy.Cargo.lock by default; for public libraries, also test latestdependency resolution because consumers use Cargo.toml.
rust-toolchain.toml version pins unless reproducibility,nightly, embedded/custom targets, or release policy requires them.
Start narrow, then broaden:
cargo check -p <crate>
cargo test -p <crate> <test_name>
cargo fmt --all -- --check
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo test --workspace --all-targets --all-features --locked
cargo test --doc --workspace --lockedUse cargo nextest run when configured. Add cargo hack, cargo deny, cargo audit, cargo semver-checks, or release tooling only when the repo or change surface warrants it.
scripts/discover-rust-gates.mjs [repo-root]: print likely Rust gates.scripts/check-reference-links.mjs <skill-dir...>: validate local skill links.scripts/check-trigger-evals.mjs <skill-dir...>: validate trigger eval JSON.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.