rust-crate-release
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of established Rust ecosystem tools, including
cargo-semver-checksandcargo-audit, from the official Crates.io registry via thecargo installcommand. - [COMMAND_EXECUTION]: The instructions involve executing standard Rust toolchain commands such as
cargo build,cargo test,cargo clippy, andcargo fmtto perform local verification and testing of the codebase. - [DATA_EXFILTRATION]: The skill manages the transmission of code and metadata to the official Crates.io registry via
cargo publish. This is the core intended functionality and includes explicit safeguards against accidental credential exposure and unauthorized writes. - [SAFE]: The skill demonstrates high security maturity by providing specific instructions to prevent path traversal attacks during archive extraction and to ensure sensitive files like private keys or
.envfiles are not included in release artifacts. - [SAFE]: Guidelines for using GitHub Actions include security best practices such as pinning actions to specific commit SHAs and utilizing OIDC identities (Trusted Publishing) to avoid long-lived secrets.
Audit Metadata