rust-review

Rust Security Review Runs in the main conversation (invoke via /rust-review:rust-review ). Orchestrator owns the Task ledger as bookkeeping for retries; workers and judges have no Task tools. Workers and judges are named plugin subagents ( rust-review:rust-review-worker , rust-review:rust-review-dedup-judge , rust-review:rust-review-fp-judge ); tool sets are declared in plugins/rust-review/agents/.md . Findings are exchanged via markdown-with-YAML files in a shared output directory. When to Use Rust application/library security review: safe/unsafe boundary auditing, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS on servers, FFI safety, async-runtime mistakes. When NOT to Use Pure-C / pure-C++ codebases — use c-review instead. Smart contracts (Solana programs / NEAR contracts / Ink!) — use solana-vulnerability-scanner or the contract-specific skill. Kernel-mode Rust drivers without userspace allocator — coverage is incomplete; flag as advisory only. Secrets/key memory hygiene (zeroization, Zeroize / ZeroizeOnDrop / secrecy usage, lingering stack/heap copies) — use the zeroize-audit skill; rust-review does not cover memory zeroization. Subagents Show more Installs 982 Repository trailofbits/skills GitHub Stars 6.9K First Seen Jun 30, 2026 Security Audits Gen Agent Trust Hub Pass Socket Pass Snyk Pass