rust-crate-release

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of established Rust ecosystem tools, including cargo-semver-checks and cargo-audit, from the official Crates.io registry via the cargo install command.
  • [COMMAND_EXECUTION]: The instructions involve executing standard Rust toolchain commands such as cargo build, cargo test, cargo clippy, and cargo fmt to perform local verification and testing of the codebase.
  • [DATA_EXFILTRATION]: The skill manages the transmission of code and metadata to the official Crates.io registry via cargo publish. This is the core intended functionality and includes explicit safeguards against accidental credential exposure and unauthorized writes.
  • [SAFE]: The skill demonstrates high security maturity by providing specific instructions to prevent path traversal attacks during archive extraction and to ensure sensitive files like private keys or .env files are not included in release artifacts.
  • [SAFE]: Guidelines for using GitHub Actions include security best practices such as pinning actions to specific commit SHAs and utilizing OIDC identities (Trusted Publishing) to avoid long-lived secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 06:29 AM