360 Secure SkillHub
360 安全技能中心

rust-review

该 Skill 提供 Rust 代码审查工作流,按所有权、错误处理、并发、unsafe 审计和 Cargo 依赖检查逐步加载模块,并输出包含问题证据与批准/阻断建议的 Markdown 报告。它面向安全与正确性审查,不包含性能剖析或自动修复。

athola
athola
热度 61.96
最近更新 2026-08-26 21:21:06
分类:安全依赖:读写文件应用场景:代码审查 / 报告撰写

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add nm-pensive-rust-review
Metadata
name
rust-review
description
Audits Rust code for unsafe blocks, ownership issues, and Cargo dependency risks
version
1.9.8
triggers
["rust","ownership","concurrency","unsafe","traits","cargo","reviewing Rust code or before merging Rust changes"]
metadata
{"openclaw":{"homepage":"https://github.com/athola/claude-night-market/tree/master/plugins/pensive","emoji":"🔍","requires":{"config":["night-market.pensive:shared","night-market.imbue:proof-of-work"]}}}
source
claude-night-market
source_plugin
pensive

Night Market Skill — ported from claude-night-market/pensive. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Table of Contents

Rust Review Workflow

Expert-level Rust code audits with focus on safety, correctness, and idiomatic patterns.

Quick Start

/rust-review

Verification: Run the command with --help flag to verify availability.

When To Use

  • Reviewing Rust code changes
  • Auditing unsafe blocks
  • Analyzing concurrency patterns
  • Dependency security review
  • Performance optimization review

When NOT To Use

  • General code review without Rust - use unified-review
  • Performance profiling - use parseltongue:python-performance pattern

Required TodoWrite Items

  1. rust-review:ownership-analysis
  2. rust-review:error-handling
  3. rust-review:concurrency
  4. rust-review:unsafe-audit
  5. rust-review:cargo-deps
  6. rust-review:evidence-log

Progressive Loading

Load modules as needed based on review scope:

Quick Review (ownership and errors):

  • See modules/ownership-analysis.md for borrowing and lifetime analysis
  • See modules/error-handling.md for Result/Option patterns

Concurrency Focus:

  • See modules/concurrency-patterns.md for async and sync primitives

Safety Audit:

  • See modules/unsafe-audit.md for unsafe block documentation

Dependency Review:

  • See modules/cargo-dependencies.md for vulnerability scanning

Idiomatic Patterns:

  • See modules/builtin-preference.md for conversion traits and builtin preference

Core Workflow

  1. Ownership Analysis: Check borrowing, lifetimes, clone patterns
  2. Error Handling: Verify Result/Option usage, propagation
  3. Concurrency: Review async patterns, sync primitives
  4. Unsafe Audit: Document invariants, FFI contracts
  5. Dependencies: Scan for vulnerabilities, updates
  6. Evidence Log: Record commands and findings

Rust Quality Checklist

Safety

  • All unsafe blocks documented with SAFETY comments
  • FFI boundaries properly wrapped
  • Memory safety invariants maintained
  • mlock/munlock calls: RLIMIT verified, page-aligned, ENOMEM handled

Correctness

  • Error handling complete
  • Concurrency patterns sound
  • Tests cover critical paths

Performance

  • No unnecessary allocations
  • Borrowing preferred over cloning
  • Async properly non-blocking

Idioms

  • Standard traits implemented
  • Conversion traits preferred over helper functions
  • Error types well-designed
  • Documentation complete

Output Format

## Summary
Rust audit findings

## Ownership Analysis
[borrowing and lifetime issues]

## Error Handling
[error patterns and issues]

## Concurrency
[async and sync patterns]

## Unsafe Audit
### [U1] file:line
- Invariants: [documented]
- Risk: [assessment]
- Recommendation: [action]

## Dependencies
[cargo audit results]

## Recommendation
Approve / Approve with actions / Block

Verification: Run the command with --help flag to verify availability.

Exit Criteria

  • All unsafe blocks audited
  • Concurrency patterns verified
  • Dependencies scanned
  • Evidence logged
  • Action items assigned