cargo-audit

Estrellas1

Forks0

Actualizado19 de abril de 2026 a las 20:28

Run cargo audit and triage advisories by crate scope. Use whenever bumping dependencies, editing Cargo.toml or Cargo.lock, or investigating a RUSTSEC advisory. Also triggers on user phrases like "audit deps", "check CVEs", "are our dependencies safe".

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Fuente

dwalleck

dwalleck/kiro-control-center

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	cargo-audit
description	Run cargo audit and triage advisories by crate scope. Use whenever bumping dependencies, editing Cargo.toml or Cargo.lock, or investigating a RUSTSEC advisory. Also triggers on user phrases like "audit deps", "check CVEs", "are our dependencies safe".
user-invocable	false

Cargo Audit Runner

This workspace has a split advisory profile: kiro-market-core / kiro-market ship as a broadly-distributed CLI, while kiro-control-center is a Tauri desktop app with a much larger transitive graph (gtk-rs, wry, webkit bindings) that carries many unmaintained advisories not reachable from the CLI. Always classify advisories by scope before reporting.

When to run

Before any cargo update or dep bump
After merging a PR that touches Cargo.toml at workspace or crate level
When a user asks about dependency safety
When editing crates that parse untrusted input (agent/, skill.rs, plugin.rs, marketplace.rs)

How to run

cargo audit --json 2>/dev/null || { echo "Install: cargo install cargo-audit"; exit 1; }

For each advisory in the output:

Identify the affected crate and version.
Run cargo tree -e normal -i <affected> to find the workspace member that pulls it in.
Classify:
- Core path — in kiro-market-core or kiro-market dep graph
- Tauri path — only in kiro-control-center dep graph
- Dev-only — only through [dev-dependencies] or build scripts
Note if a fix version exists (check versions.patched in the advisory) and the upgrade path.

Known standing advisories

These are tracked and not-yet-fixed; don't re-report them as new:

RUSTSEC-2024-0320 (serde_yaml 0.9 unmaintained) — Core path. Migration to serde_yml or marked-yaml is on the roadmap. Blast radius: agent/skill frontmatter (4-field YAML), not arbitrary user YAML. Still must-fix before 1.0.
Tauri gtk-rs / wry / webkit advisories (RUSTSEC-2024-04xx / 2025-0xxx / 2026-0097 cluster) — Tauri path only. Tracked upstream by Tauri releases; we follow their version bumps.

Anything NOT on this list is new and must be triaged.

Output format

Mirror the /audit-deps slash command format. Advise the user on which bucket blocks a release vs which can wait for upstream.

If the scan is clean of new advisories, say so and list the known standing ones for context.

Exit criteria

You've done your job when the user has:

A bucketed list of advisories
A clear statement of which ones are "new and must be triaged" vs "known and tracked"
Concrete upgrade paths for fixable advisories

Más de este repositorio

mismo repositorio

rust-best-practices

dwalleck/kiro-control-center

**ALWAYS USE** when working with Rust code. This skill contains 45 rules that prevent common bugs. Trigger on ANY of these: - Editing .rs files or Cargo.toml - Writing new Rust functions, structs, enums, or impl blocks - Reviewing Rust code before committing - Debugging Rust errors (borrow checker, Option/Result, lifetimes) - Working with: unwrap, expect, ?, Option, Result, Path, PathBuf - File I/O operations in Rust (read, write, atomic writes) - CLI development with clap - Error handling patterns - Functions returning Option or Result that might fail silently - Path operations (canonicalize, file_name, parent, extension) - Deserializing JSON/YAML/TOML from external sources Key rules to apply: - Rule 35: Log before returning None (prevent silent failures) - Rule 36: Return Err for invalid input, not empty collections - Rule 37: Canonicalize paths at system boundaries - Rule 39: Every public method needs tests - Rule 40: Validate untrusted data at point of use - Rule 41: Audit ergonomic error suppressors (.

2026-04-261

assertion-quality

dwalleck/kiro-control-center

Analyzes the variety and depth of assertions across test suites in any supported language. Use when the user asks to evaluate assertion quality, find shallow testing, identify tests with only trivial assertions, measure assertion diversity, or audit whether tests verify different facets of correctness. Produces metrics and actionable recommendations. Supports Rust and .NET (MSTest, xUnit, NUnit, TUnit). Also detects implicit assertions, panic/exception testing, mock verification, and framework-specific patterns. DO NOT USE FOR: writing new tests, detecting general anti-patterns, or fixing existing assertions — help the user directly with those.

2026-04-151

cargo-check

dwalleck/kiro-control-center

Run cargo check after Rust file modifications to catch compile errors early

2026-04-031

Cargo Audit Runner

When to run

Before any cargo update or dep bump

After merging a PR that touches Cargo.toml at workspace or crate level

When a user asks about dependency safety

When editing crates that parse untrusted input (agent/, skill.rs, plugin.rs, marketplace.rs)

How to run

cargo audit --json 2>/dev/null || { echo "Install: cargo install cargo-audit"; exit 1; }

For each advisory in the output:

Identify the affected crate and version.

Run cargo tree -e normal -i <affected> to find the workspace member that pulls it in.

Classify:

Core path — in kiro-market-core or kiro-market dep graph
Tauri path — only in kiro-control-center dep graph
Dev-only — only through [dev-dependencies] or build scripts

Note if a fix version exists (check versions.patched in the advisory) and the upgrade path.

Known standing advisories

These are tracked and not-yet-fixed; don't re-report them as new:

RUSTSEC-2024-0320 (serde_yaml 0.9 unmaintained) — Core path. Migration to serde_yml or marked-yaml is on the roadmap. Blast radius: agent/skill frontmatter (4-field YAML), not arbitrary user YAML. Still must-fix before 1.0.

Tauri gtk-rs / wry / webkit advisories (RUSTSEC-2024-04xx / 2025-0xxx / 2026-0097 cluster) — Tauri path only. Tracked upstream by Tauri releases; we follow their version bumps.

Anything NOT on this list is new and must be triaged.

Output format

Mirror the /audit-deps slash command format. Advise the user on which bucket blocks a release vs which can wait for upstream.

If the scan is clean of new advisories, say so and list the known standing ones for context.

Exit criteria

You've done your job when the user has:

A bucketed list of advisories

A clear statement of which ones are "new and must be triaged" vs "known and tracked"

Concrete upgrade paths for fixable advisories