rust-tooling-cicd

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses community-standard GitHub Actions to facilitate CI/CD processes.
  • Fetches the Rust toolchain using dtolnay/rust-toolchain.
  • Installs prebuilt binaries for tools like cargo-deny, cargo-audit, and cargo-nextest using taiki-e/install-action.
  • Caches build artifacts using Swatinem/rust-cache.
  • [COMMAND_EXECUTION]: The skill defines a sequence of shell commands to be executed in a CI environment.
  • Executes cargo fmt, cargo clippy, cargo deny, cargo audit, and cargo nextest for codebase validation.
  • Includes cargo machete --fix in its reference guide, which performs automated modifications to project Cargo.toml files.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design.
  • Ingestion points: Reads project-specific files such as Cargo.toml and .github/workflows/ci.yml, and queries external documentation via mcp__context7__query-docs (SKILL.md).
  • Boundary markers: The instructions do not specify the use of delimiters or specific instructions to ignore embedded prompts within the files being inspected.
  • Capability inventory: The skill uses commands that can modify the filesystem (cargo machete --fix) and perform network operations (cargo audit, cargo deny) across various scripts.
  • Sanitization: There is no mention of sanitizing or validating the content of the project files or external documentation before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 06:13 AM