--- title: "Rust review dedup judge: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/trailofbits-rust-review-dedup-judge/ description: "Pins the rust-review dedup judge that merges only obvious duplicates, aborts when the finding list cannot be loaded, and does not declare a shell." --- # Rust review dedup judge: review, role & definition · Undominated.ai > Pins the rust-review dedup judge that merges only obvious duplicates, aborts when the finding list cannot be loaded, and does not declare a shell. [← Explore all agents](/agents/) SECURITY REVIEW / Trail of Bits # Rust review dedup judge Pins the rust-review dedup judge that merges only obvious duplicates, aborts when the finding list cannot be loaded, and does not declare a shell. [Use this definition ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/agents) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “An orchestrator-spawned dedup judge whose required input is output_dir, that refuses an uncertain merge, and that must not delete finding files.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/agents/rust-review-dedup-judge.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The agents index has the c-review worker and not plugins/rust-review/agents/rust-review-dedup-judge.md. - The file names output_dir as its input, says it is spawned only by the rust-review orchestrator, and tells itself not to merge when a required check fails and not to delete a finding file. ### A good fit for - Consolidating rust-review finding files already written under output_dir, before the false-positive judge runs - Supply the completed findings directory, canonical index and threat-model context. - Update duplicate frontmatter and write a traceable dedup summary while keeping all original finding files. ### Weigh up before choosing - This review did not execute the resource. - A Markdown profile does not register a native subagent by itself. - The install line adds the trailofbits/skills marketplace. It does not install the rust-review plugin or this judge by itself. - The file edits finding-file frontmatter when it does merge. This review did not run a merge and did not open a sample finding. - The file's High, Medium, and Low ordering is its rule for picking a primary. It is not a score this review assigned. - Tier 3 still depends on model judgment of same-defect identity; matching a file or function is only candidacy and cannot justify merging distinct bugs. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/rust-review/agents/rust-review-dedup-judge.md - README.md - LICENSE - Round 2: pinned definition, output contract and permission/dependency boundaries reread on 2026-10-14 - plugins/rust-review/skills/rust-review/SKILL.md (selected input/output and dependency-contract sections; not a full implementation audit) ### Our findings - The description says the judge is spawned by the rust-review skill orchestrator only. The inputs section names output_dir as the absolute path to the run directory. - The prime directive says when in doubt, do not merge. If Glob and a direct read of the canonical index both fail, the file says to abort with one stated line. - Tools are Read, Write, Edit, and Glob. The body says Bash, Grep, and LSP are intentionally absent, and that finding files must not be deleted. - Tier 2 says to merge only when every listed check holds, and to leave the findings as they are if any check fails. - An empty canonical index means zero findings; recovery without that index unions worker shards with files on disk to avoid losing unindexed findings. - Previously absorbing primaries cannot become merged children, even when a later candidate has higher confidence, preventing orphaned alias chains. ### Not established by this review - The resource was not executed and its tools were not called. - No findings directory was read. - The rust-review orchestrator and the later false-positive judge were not opened. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) DOCUMENTED COMMAND /plugin marketplace add trailofbits/skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The README's Claude Code section is that line, then /plugin menu to browse plugins. - The same README names rust-review as the Rust security-review plugin in the plugin table. The marketplace command does not install that plugin by itself. - The Codex section uses codex plugin marketplace add trailofbits/skills and a placeholder plugin name, so that line is not install.command. - Use the matching review schema, preserve all files and verify merge references, counts and rerun behavior before downstream filtering. ### Before you start - Claude Code or Codex marketplace support - The skill orchestrator that spawns this agent ### Compatibility Claude Code · Codex ### Implementation rust ### On-disk dedup judge that refuses an uncertain merge - Read finding files under the dispatched output_dir - Edit frontmatter to record a merge - Do not delete a finding file, and no shell tool is declared ### Cost model CC-BY-SA-4.0; no price is stated for this agent, and it was not run 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [rust-review-dedup-judge ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/agents/rust-review-dedup-judge.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/agents/rust-review-dedup-judge.md Supports: orchestrator-only spawn, doubt rule, and no delete - [Repository README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: marketplace install line and rust-review row - [Repository LICENSE ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: Attribution-ShareAlike 4.0 International - [Pinned inspected source: plugins/rust-review/skills/rust-review/SKILL.md ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/skills/rust-review/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/skills/rust-review/SKILL.md Supports: Dependency setup and source-review boundary KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### C review worker ↗ Pins the c-review producing worker that reads source, writes one part file, and states that it has no shell.](/agents/trailofbits-c-review-worker/)[### Rust review FP judge ↗ Pins the rust-review judge that runs after dedup, aborts when it cannot obtain a finding list, and must not invent the SARIF file.](/agents/trailofbits-rust-review-fp-judge/)[### Rust review worker ↗ Pins the rust-review worker that aborts a malformed or primer spawn, writes findings only inside its scope root, and does not filter them by severity.](/agents/trailofbits-rust-review-worker/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Find reusable instructions](/skills/) - [Inspect connections](/mcp-servers/) - [Build a toolkit](/tools/) - [Choose the model](/compare/)