SECURITY REVIEW / Trail of Bits
Rust review FP judge
Pins the rust-review judge that runs after dedup, aborts when it cannot obtain a finding list, and must not invent the SARIF file.
“Second-stage Rust review judge that aborts without a finding list, gives one verdict to each merged group, and does not invent SARIF.”
01 / THE REASONING
Why this made the selection.
- The agents catalogue has no sourcePath for plugins/rust-review/agents/rust-review-fp-judge.md.
- The file aborts when the finding list is unavailable, gives one verdict to a merged group, and forbids inventing SARIF or claiming a report exists without a disk check.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/rust-review/agents/rust-review-fp-judge.md
- plugins/rust-review/README.md
- README.md
- LICENSE
Our findings
- It says not to merge duplicates, to give each merged group exactly one verdict, and not to invoke Skill.
- If the findings index is missing and the fallback list returns nothing, it says to abort. If a list was obtained and is empty, and the dedup summary is absent, it says to write both reports for a zero-findings run.
- Under the remote threat model, a bug that needs local config, command-line arguments, environment variables, or an existing shell is out of scope, and a non-survivor gets no severity.
- It says not to use the Write tool for the report file, not to hand-write SARIF, and not to claim either output exists without checking the files on disk.
Not established by this review
- The resource was not executed and its tools were not called.
- No findings directory was supplied.
- The bundled SARIF generator was not opened or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Use the role in your project.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README prints that line with no leading spaces, then /plugin menu on the next fence line.
- That command adds the Trail of Bits marketplace. It does not install this agent.
- The rust-review README's invoke line names the skill. It is not a single-line install command, so it is not install.command.
Before you start
- Claude Code or Codex marketplace support, which the repository README states
- A rust-review orchestrator spawn with an output directory
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- rust-review-fp-judge ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/agents/rust-review-fp-judge.md
Supports: one verdict per group, abort without a list, and no invented SARIF
- Repository root LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Attribution-ShareAlike 4.0 International
- rust-review README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/rust-review/README.md
Supports: fp-judge runs second and writes the final reports
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: CC-BY-SA-4.0 statement and marketplace install line