rust-review — Claude Code skill: what it does, how to install
Audits Rust crates and libraries for memory safety in unsafe blocks, FFI boundaries, concurrency bugs, and panic DoS. Useful for in-depth security reviews.
npx skills add trailofbits/skills --skill rust-review -a claude-codeWhat rust-review does
The skill orchestrates a multi-step audit pipeline. A coordinator dispatches parallel worker subagents (rust-review:rust-review-worker) across vulnerability clusters. Next, a deduplication judge merges identical findings, and a false-positive judge validates severity before compiling the final reports in REPORT.md and REPORT.sarif.
The process strictly isolates the audit target from read-only project context. Workers can inspect callers and build settings across the repository to confirm reachability, but they only record vulnerabilities inside the requested target subtree. File searches rely on rg or grep -E, and planning scripts run via uv run.
Memory zeroization and smart contract bugs fall outside this skill's scope, so running it on Solana programs or secrets-clearing code will miss vulnerabilities. Pure safe-Rust projects still benefit from the run. Denial of service from panics and atomic race conditions do not need unsafe to cause outages.
What it helps with
- audit memory safety violations inside
unsafeblocks - catch panic-induced denial of service flaws in backend servers
- detect data races and deadlocks across concurrent or async code
- verify type layouts and safety assumptions across FFI boundaries
Example prompts for the agent
- /rust-review:rust-review audit this crate for memory safety vulnerabilities
- /rust-review:rust-review check the src/ffi directory for boundary bugs
- /rust-review:rust-review review our async server code for panic-induced DoS
How to install rust-review
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill rust-review -a claude-code2Manually: put the files in place
~/.claude/skills/rust-review/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/rust-review/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill rust-review -a codex2Manually: put the files in place
.agents/skills/rust-review/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill rust-review -a cursor2Manually: put the files in place
.cursor/skills/rust-review/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install trailofbits/skills rust-review2Manually: put the files in place
.github/skills/rust-review/SKILL.md1Skills CLI (Vercel)
npx skills add trailofbits/skills --skill rust-review -a gemini-cli2Platform CLI
gemini skills install https://github.com/trailofbits/skills --path plugins/rust-review/skills/rust-reviewManually: put the files in place
.devin/skills/rust-review/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add trailofbits/skills --skill rust-review -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about rust-review
How to install rust-review in Claude Code?
Run npx skills add trailofbits/skills --skill rust-review -a claude-code in your terminal. It writes the configuration to ~/.claude/skills/rust-review/SKILL.md.
What does rust-review check?
It evaluates safe and unsafe boundaries, memory corruption hazards, FFI mismatches, and panic-triggered server crashes. It generates findings in both REPORT.md and REPORT.sarif.
Does rust-review audit smart contracts or secrets zeroization?
No, it skips smart contracts like Solana or NEAR programs and does not inspect Zeroize memory wiping. Separate specialized skills handle those checks.
