# rust-review

Audits Rust crates and libraries for memory safety in unsafe blocks, FFI boundaries, concurrency bugs, and panic DoS. Useful for in-depth security reviews.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2000 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/rust-review/skills/rust-review/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/rust-review

## What it does

The skill orchestrates a multi-step audit pipeline. A coordinator dispatches parallel worker subagents (`rust-review:rust-review-worker`) across vulnerability clusters. Next, a deduplication judge merges identical findings, and a false-positive judge validates severity before compiling the final reports in `REPORT.md` and `REPORT.sarif`.

The process strictly isolates the audit target from read-only project context. Workers can inspect callers and build settings across the repository to confirm reachability, but they only record vulnerabilities inside the requested target subtree. File searches rely on `rg` or `grep -E`, and planning scripts run via `uv run`.

Memory zeroization and smart contract bugs fall outside this skill's scope, so running it on Solana programs or secrets-clearing code will miss vulnerabilities. Pure safe-Rust projects still benefit from the run. Denial of service from panics and atomic race conditions do not need `unsafe` to cause outages.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill rust-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rust-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rust-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill rust-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rust-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill rust-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rust-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills rust-review
```

2. **Manually: put the files in place**
- File: `.github/skills/rust-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill rust-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/rust-review/skills/rust-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rust-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill rust-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/rust-review/skills/rust-review/SKILL.md

## When to use it
- audit memory safety violations inside `unsafe` blocks
- catch panic-induced denial of service flaws in backend servers
- detect data races and deadlocks across concurrent or async code
- verify type layouts and safety assumptions across FFI boundaries

## Example prompts
- /rust-review:rust-review audit this crate for memory safety vulnerabilities
- /rust-review:rust-review check the src/ffi directory for boundary bugs
- /rust-review:rust-review review our async server code for panic-induced DoS

## Similar
- [security-review](https://affpapa.org/en/nevibecode/skills/getsentry-security-review.md) — skill · 21300 installs
- [thermo-nuclear-review](https://affpapa.org/en/nevibecode/skills/thermo-nuclear-review.md) — skill · 2700 installs
- [rust-best-practices](https://affpapa.org/en/nevibecode/skills/rust-best-practices.md) — skill · 21100 installs
- [rust-skills](https://affpapa.org/en/nevibecode/skills/rust-skills.md) — skill · 6500 installs
- [rust-security](https://affpapa.org/en/nevibecode/skills/rust-security.md) — skill · 544 installs
- [azure-keyvault-secrets-rust](https://affpapa.org/en/nevibecode/skills/azure-keyvault-secrets-rust.md) — skill · 6 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md