SECURITY REVIEW / Trail of Bits
Rust review
Reviews Rust unsafe, FFI and concurrency, and lists rationalisations the reviewer must reject.
“Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.”
01 / THE REASONING
Why this made the selection.
- The definition has both When to Use and When NOT to Use headings.
- A Rationalizations to Reject heading is present, so a clean reading is not the same as a pass.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/rust-review/skills/rust-review/SKILL.md
- README.md
- LICENSE
- plugins/rust-review/scripts/build_run_plan.py
Our findings
- Description names unsafe boundaries, panic-induced DoS, FFI and async mistakes.
- Headings include Orchestration Workflow.
- The planner CLI and worker-output paths were inspected: explicit capability booleans select clusters and generated prompts preserve finding scope separately from context.
- The dedup judge and the false-positive judge run in separate messages, in that order, and Phase 8 still runs when the index is empty.
Not established by this review
- The skill was not executed inside a host agent.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- In Claude Code, add the upstream marketplace, then use /plugin menu to select the rust-review plugin. Adding a marketplace alone does not install a plugin.
- The marketplace command follows upstream HEAD. To reproduce this review, obtain revision 82fe8226252622fa807643bdca1710901198553a and configure the complete checked-out plugin through the host’s local-plugin workflow.
- Keep the whole plugin, including its references, scripts and named agents; inspect its tool access before an authorized task.
Before you start
- The entire rust-review plugin, uv, Rust source and a host supporting its named agents and task protocol.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/rust-review/skills/rust-review/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: Redistribution terms
- Install instructions ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md
Supports: Documented install path
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/rust-review/scripts/build_run_plan.py
Supports: review, limitations, access, install