Name: testland/cargo-audit-rust
Rating: 75.2 (1 reviews)
Author: testland

testland/cargo-audit-rust

Configures and runs cargo-audit against the RustSec Advisory Database for Rust projects; covers `cargo audit` (vulnerability scan), `cargo audit fix` (automated dependency updates), `--deny unmaintained|unsound|yanked|warnings` exit-code control, `audit.toml` per-advisory suppression with mandatory `expires` + `reason`, SARIF output for GitHub Code Scanning upload, and `rustsec/audit-check` GitHub Actions integration. Use when the codebase has a Cargo.lock and needs Rust-specific SCA beyond what the multi-ecosystem npm-pip-maven-audit wrapper provides.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-structured: a clear step sequence, executable commands, validation on the mutating fix step, and clean one-level-deep progressive disclosure to a verified reference file. The only weakness is conciseness - an inline time-sensitive version pin and a restated differentiation add tokens that don't all earn their place.

Suggestions

Move or soften the time-sensitive "Minimum Rust version: 1.74" (e.g., defer it to the reference file, or frame it as 'see rustsec-readme for the current minimum Rust version') so the body does not carry a value that will go stale.

Trim the 'Differentiation from npm-pip-maven-audit' section since the description already states the distinction; a one-line pointer or removing it would save tokens without losing signal.

Consolidate the repeated per-step '([rustsec-readme][rustsec-readme])' citations into a single Sources/References note to reduce citation noise.

Dimension	Reasoning	Score
Conciseness	Mostly lean - tables, code blocks, concise sections, no padding about what crates are - but the time-sensitive "Minimum Rust version: 1.74" appears inline in Step 1 outside any 'deprecated/old patterns' section, and the "Differentiation from npm-pip-maven-audit" block restates the description; this fits the score-2 'mostly efficient but could be tightened' anchor rather than a clean score-3.	2 / 3
Actionability	Fully executable, copy-paste-ready commands throughout - `cargo install cargo-audit --locked`, `cargo audit -f path/to/Cargo.lock`, `cargo audit --deny unmaintained`, `cargo audit --format json > cargo-audit.json`, `cargo audit fix --dry-run` - plus a real `audit.toml` block, matching the score-3 'fully executable, copy-paste ready' anchor and not the score-2 'pseudocode / missing key details' anchor.	3 / 3
Workflow Clarity	Clear Steps 1-7 sequence with an explicit validation checkpoint on the destructive `cargo audit fix` step ("Always run `cargo test` after applying fixes") plus a `--dry-run` preview, error-recovery guidance via the exit-code table (code 2 = execution error), and an anti-patterns checklist - matching the score-3 anchor; validation is present on the mutating operation so it is not capped at 2.	3 / 3
Progressive Disclosure	Overview keeps the core while the full `audit.toml` schema, binary auditing, and CI wiring are split to the real, one-level-deep `references/cargo-audit-config-and-ci.md`, clearly signaled with descriptive link text - matching the score-3 'clear overview with well-signaled one-level-deep references' anchor rather than the score-2 'content that should be separate is inline' anchor.	3 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it enumerates concrete cargo-audit capabilities, gives an explicit 'Use when' trigger tied to Cargo.lock and Rust-specific SCA, and explicitly differentiates itself from the npm-pip-maven-audit wrapper. It uses third-person voice with the accepted 'Use when...' trigger pattern. All four dimensions score at the top of the scale.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions - "Configures and runs cargo-audit", "covers `cargo audit` (vulnerability scan), `cargo audit fix` (automated dependency updates), `--deny ...` exit-code control, `audit.toml` ... suppression ..., SARIF output ..., `rustsec/audit-check` GitHub Actions integration" - matching the score-3 anchor rather than the score-2 'some actions' anchor.	3 / 3
Completeness	Clearly answers both 'what' (the enumerated capabilities) and 'when' with an explicit trigger - "Use when the codebase has a Cargo.lock and needs Rust-specific SCA beyond what the multi-ecosystem npm-pip-maven-audit wrapper provides" - matching the score-3 anchor and not the score-2 'when missing or only implied' anchor.	3 / 3
Trigger Term Quality	Good coverage of natural terms a Rust user would say - "cargo-audit", "RustSec", "Cargo.lock", "vulnerability scan", "SARIF", "GitHub Code Scanning" - with a "Use when the codebase has a Cargo.lock" trigger; 'SCA' is mild jargon but the domain terms dominate, so it clears the score-3 bar over the score-2 'missing common variations' anchor.	3 / 3
Distinctiveness Conflict Risk	Explicitly differentiates from `npm-pip-maven-audit` ("beyond what the multi-ecosystem npm-pip-maven-audit wrapper provides") and occupies a clear Rust-specific niche (Cargo.lock, RustSec, cargo audit) with distinct triggers, unlikely to conflict - matching the score-3 anchor over the score-2 'could still overlap' anchor.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

1 day ago

Table of Contents

Discovery Implementation Validation