The Agent Skills Directory

[COMMAND_EXECUTION]: The skill configuration allows and encourages the execution of cargo run -- *. This command executes the binary of the Rust project currently being audited. In the context of a health check or security audit, running untrusted code from a project under review is a significant security risk, as it allows the project to execute arbitrary code on the user's system via build scripts (build.rs) or the application's own logic.
[REMOTE_CODE_EXECUTION]: The instructions explicitly recommend using bunx rust-doctor@latest if the tool is not found in the path. This pattern involves fetching and executing the latest version of a package from the npm registry at runtime without version pinning or integrity verification, which introduces a supply chain risk where a compromised package could execute malicious code.
[EXTERNAL_DOWNLOADS]: The skill includes a command rust-doctor --install-deps, which is designed to download and install external dependencies and system tools. This operation involves unverified network downloads that can modify the system configuration and install third-party software.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core workflow of reading and analyzing external source code.
Ingestion points: The agent uses the Read, Grep, and Glob tools to ingest Rust source files (referenced in SKILL.md).
Boundary markers: There are no boundary markers or instructions to treat ingested code as data only; the agent is told to "apply senior Rust reviewer expertise" to the content.
Capability inventory: The agent has access to powerful shell capabilities via Bash (including cargo run and rust-doctor).
Sanitization: There is no evidence of sanitization or filtering for the external code content before it is processed by the agent. A malicious Rust file could contain embedded instructions in comments designed to manipulate the agent's behavior during the audit.

rust-doctor