What problem does it solve? Rust code reviews repeatedly surface the same classes of bugs: synthetic std::io::Error values that erase error types, timing-leaking secret comparisons, inline passwords visible in process lists, heavyweight crates pulled in for one narrow job, and structs whose invalid field combinations are constructible. This Skill encodes the concrete fixes for each of these findings so they are caught at writing or review time. ## Core Features & Use Cases - Error handling rules: Replace synthetic std::io::Error with dedicated thiserror enum variants and preserve the error source chain with anyhow::Context or #[from] attributes. - Secrets and credential handling: Enforce constant-time XOR-fold comparison for tokens and passwords, and prefer --password-file over inline --password CLI arguments. - Dependency and type design guidance: Choose minimal purpose-specific crates, feature-gate heavy optional dependencies, and make invalid states unrepresentable by bundling coupled fields behind a single Option. - Use Case: While reviewing a Rust CLI that accepts an auth token, apply the Skill to replace a short-circuiting byte comparison with a constant-time XOR-fold, switch the CLI to --password-file, and run cargo clippy with warnings denied before committing. ## Quick Start Review this Rust crate for error handling, secret comparison, dependency, and type design issues using the coding-rust checks.
