The Agent Skills Directory

[SAFE]: Dependency Integrity: The skill enforces the use of the --locked flag for all Cargo commands in CI and automated environments. This ensures that the build only uses dependencies as specified in the Cargo.lock file, preventing unauthorized or silent dependency updates.
[SAFE]: Supply Chain Protection: The instructions explicitly recommend pinning GitHub Actions to full commit SHAs rather than mutable tags, which protects the workflow from upstream account compromises or tag-switching attacks.
[SAFE]: Execution Isolation: The skill provides clear warnings regarding the risks of build scripts and procedural macros. It advises running unvetted updates on GitHub-hosted runners with restricted permissions (contents: read) and no secrets, specifically to prevent data exfiltration from self-hosted environments.
[SAFE]: Least Privilege: It recommends scoping secrets and avoiding the caching of sensitive directories (like target/ when using Miri) to prevent accidental secret leakage through build artifacts, referencing specific known security advisories.

cargo-workflows