The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The example file examples/golden-deps/Cargo.lock contains a poisoned dependency graph. The entry for the standard serde_json crate (version 1.0.151) has been modified to include an additional dependency, zmij (version 1.0.23), which is not part of the official crate. A similar pattern is seen with serde_core. This represents a lockfile-poisoning supply-chain attack vector. Although found in an example directory, the skill explicitly refers to this as an 'audited dep set' in SKILL.md, which may lead users to adopt these files and inadvertently execute untrusted code during a cargo build or cargo test operation.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing well-known security tools like cargo-deny and cargo-audit from the official Crates.io registry. It also references the official rustsec/advisory-db on GitHub. These are recognized, trusted services within the Rust ecosystem.
[SAFE]: The skill follows security best practices regarding credential management for private registries. It correctly advises users to manage tokens via environment variables or local credentials.toml files and explicitly warns against committing these secrets to version control systems.

rust-dependencies