菜单
Run cargo audit and triage advisories by crate scope. Use whenever bumping dependencies, editing Cargo.toml or Cargo.lock, or investigating a RUSTSEC advisory. Also triggers on user phrases like "audit deps", "check CVEs", "are our dependencies safe".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
**ALWAYS USE** when working with Rust code. This skill contains 45 rules that prevent common bugs. Trigger on ANY of these: - Editing .rs files or Cargo.toml - Writing new Rust functions, structs, enums, or impl blocks - Reviewing Rust code before committing - Debugging Rust errors (borrow checker, Option/Result, lifetimes) - Working with: unwrap, expect, ?, Option, Result, Path, PathBuf - File I/O operations in Rust (read, write, atomic writes) - CLI development with clap - Error handling patterns - Functions returning Option or Result that might fail silently - Path operations (canonicalize, file_name, parent, extension) - Deserializing JSON/YAML/TOML from external sources Key rules to apply: - Rule 35: Log before returning None (prevent silent failures) - Rule 36: Return Err for invalid input, not empty collections - Rule 37: Canonicalize paths at system boundaries - Rule 39: Every public method needs tests - Rule 40: Validate untrusted data at point of use - Rule 41: Audit ergonomic error suppressors (.
Analyzes the variety and depth of assertions across test suites in any supported language. Use when the user asks to evaluate assertion quality, find shallow testing, identify tests with only trivial assertions, measure assertion diversity, or audit whether tests verify different facets of correctness. Produces metrics and actionable recommendations. Supports Rust and .NET (MSTest, xUnit, NUnit, TUnit). Also detects implicit assertions, panic/exception testing, mock verification, and framework-specific patterns. DO NOT USE FOR: writing new tests, detecting general anti-patterns, or fixing existing assertions — help the user directly with those.
Run cargo check after Rust file modifications to catch compile errors early
| name | cargo-audit |
| description | Run cargo audit and triage advisories by crate scope. Use whenever bumping dependencies, editing Cargo.toml or Cargo.lock, or investigating a RUSTSEC advisory. Also triggers on user phrases like "audit deps", "check CVEs", "are our dependencies safe". |
| user-invocable | false |
This workspace has a split advisory profile: kiro-market-core / kiro-market ship as a broadly-distributed CLI, while kiro-control-center is a Tauri desktop app with a much larger transitive graph (gtk-rs, wry, webkit bindings) that carries many unmaintained advisories not reachable from the CLI. Always classify advisories by scope before reporting.
cargo update or dep bumpCargo.toml at workspace or crate levelagent/, skill.rs, plugin.rs, marketplace.rs)cargo audit --json 2>/dev/null || { echo "Install: cargo install cargo-audit"; exit 1; }
For each advisory in the output:
Identify the affected crate and version.
Run cargo tree -e normal -i <affected> to find the workspace member that pulls it in.
Classify:
kiro-market-core or kiro-market dep graphkiro-control-center dep graph[dev-dependencies] or build scriptsNote if a fix version exists (check versions.patched in the advisory) and the upgrade path.
These are tracked and not-yet-fixed; don't re-report them as new:
serde_yaml 0.9 unmaintained) — Core path. Migration to serde_yml or marked-yaml is on the roadmap. Blast radius: agent/skill frontmatter (4-field YAML), not arbitrary user YAML. Still must-fix before 1.0.Anything NOT on this list is new and must be triaged.
Mirror the /audit-deps slash command format. Advise the user on which bucket blocks a release vs which can wait for upstream.
If the scan is clean of new advisories, say so and list the known standing ones for context.
You've done your job when the user has: