What problem does it solve? Rust projects face two distinct security risks: vulnerable or malicious crates entering the dependency graph, and parsers that mishandle adversarial files, archives, or binary formats. This Skill provides concrete cargo-audit and cargo-deny workflows, dependency vetting gates, and parser hardening rules to address both. ## Core Features & Use Cases - Advisory and policy enforcement: Run cargo-audit and cargo-deny with correct version-pinned commands, triage RUSTSEC advisories by kind (vulnerability, unsound, unmaintained, malicious), and write time-boxed ignore entries with tracking links. - Dependency vetting gate: Apply a six-step review to every new Cargo.lock package, including typosquat identity checks, published-source inspection of build scripts and proc macros, and a no-compile rule until vetting passes. - Malicious crate response: Follow an incident playbook for compromised releases, including lockfile rollback, local cache deletion, and credential rotation reporting. - Untrusted-input parser hardening: Enforce length caps, checked arithmetic, recursion limits, path traversal rejection, and safe hasher choices for parsers reading archives, XML, JSON, SQLite, or binary containers. - Use Case: A pull request adds a new transitive dependency. Use this Skill to vet the crate's identity and published source before compiling, then run cargo deny to confirm the candidate graph passes policy. ## Quick Start Ask the agent to audit the workspace dependencies with cargo-audit and cargo-deny and triage any RUSTSEC findings in Cargo.lock.
