What problem does it solve? Rust projects with multiple crates and pinned toolchains risk supply-chain vulnerabilities, license violations, stale lockfiles, and MSRV-breaking updates when dependencies change. This Skill enforces a repeatable verification workflow so dependency changes are checked against security advisories, deny policies, and reproducible-build requirements before they ship. ## Core Features & Use Cases - Lockfile and toolchain verification: Confirms Cargo.lock files are committed, runs locked metadata/tree/build commands, and checks toolchain versions against rust-toolchain.toml for independent backend (Rust 1.88) and desktop (Rust 1.90) crates. - Security and license auditing: Runs cargo deny check in both crates to catch advisories, banned dependencies, unknown sources, and license violations, treating a missing cargo-deny as a failed check. - Safe update previews: Uses cargo update --dry-run --locked with incompatible-rust-versions fallback to preview semver-compatible updates without exceeding MSRV, then records commands, exit codes, and advisory freshness as evidence. - Use Case: After bumping a dependency in Cargo.toml, run this Skill to confirm both lockfiles stay reproducible, cargo deny passes, no new unsafe blocks lack safety arguments, and the pinned quality bar still passes before pushing the PR. ## Quick Start Verify the Cargo dependencies, advisories, licenses, and lockfiles for both the backend and desktop crates before I push this PR.
