rust-security
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard Rust toolchain commands to manage security tools.
- Evidence:
cargo install cargo-audit --locked,cargo install cargo-deny --locked,cargo install cargo-fuzz,cargo install honggfuzz,cargo install cargo-vet,cargo install cargo-machete, andrustup +nightly component add miri. - [EXTERNAL_DOWNLOADS]: The skill references the well-known
rustsec.orgdatabase to retrieve security advisories. - Evidence:
curl https://rustsec.org/advisories/RUSTSEC-2023-0001.jsonis used to fetch vulnerability data for review. - [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON advisory data and command outputs, which presents a potential surface for indirect prompt injection.
- Ingestion points: JSON output from
cargo auditand advisories fetched fromrustsec.org. - Capability inventory: The skill utilizes file system access and shell command execution for auditing purposes.
- Sanitization: Not explicitly defined for the ingested JSON data.
- Note: This is a low-risk surface inherent to the skill's purpose of security auditing.
Audit Metadata