rust-tooling-cicd
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses community-standard GitHub Actions to facilitate CI/CD processes.
- Fetches the Rust toolchain using
dtolnay/rust-toolchain. - Installs prebuilt binaries for tools like
cargo-deny,cargo-audit, andcargo-nextestusingtaiki-e/install-action. - Caches build artifacts using
Swatinem/rust-cache. - [COMMAND_EXECUTION]: The skill defines a sequence of shell commands to be executed in a CI environment.
- Executes
cargo fmt,cargo clippy,cargo deny,cargo audit, andcargo nextestfor codebase validation. - Includes
cargo machete --fixin its reference guide, which performs automated modifications to projectCargo.tomlfiles. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design.
- Ingestion points: Reads project-specific files such as
Cargo.tomland.github/workflows/ci.yml, and queries external documentation viamcp__context7__query-docs(SKILL.md). - Boundary markers: The instructions do not specify the use of delimiters or specific instructions to ignore embedded prompts within the files being inspected.
- Capability inventory: The skill uses commands that can modify the filesystem (
cargo machete --fix) and perform network operations (cargo audit,cargo deny) across various scripts. - Sanitization: There is no mention of sanitizing or validating the content of the project files or external documentation before processing.
Audit Metadata