Overview
rust-review is an open-source backend skill for Claude Code and compatible agents, published by trailofbits. Its author describes it as: “Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crate…”. The project has 6.6k stars on GitHub and is available under the CC-BY-SA-4.0 license. Add it to your setup with `/plugin marketplace add trailofbits/skills`.
What rust-review does
Runs in the main conversation (invoke via `/rust-review:rust-review`). Orchestrator owns the `Task*` ledger as bookkeeping for retries; workers and judges have no Task tools. Workers and judges are named plugin subagents (`rust-review:rust-review-worker`, `rust-review:rust-review-dedup-judge`, `rust-review:rust-review-fp-judge`); tool sets are declared in `plugins/rust-review/agents/*.md`. Findings are exchanged via markdown-with-YAML files in a shared output directory.
What’s inside
The SKILL.md for rust-review is organised into these sections:
- When to Use
- When NOT to Use
- Subagents
- Architecture
- Rationalizations to Reject
- Orchestration Workflow
- Phase 0: Parameter Collection
- Phase 1: Prerequisites
- Phase 2: Output Directory
- Phase 3: Codebase Context
- Phase 4: Build Run Plan (deterministic)
- Phase 5: Create Bookkeeping Tasks (orchestrator-internal)
Installation
Add rust-review to your agent with:
/plugin marketplace add trailofbits/skillsReview a skill’s source before installing it — skills can instruct your agent to run commands. This command comes from the skill’s public repository, which is the source of truth for setup steps. New to skills? Read how to install Claude Code skills.
Supported agents
- Claude Code — ships a claude code plugin marketplace
License
rust-review is published under the CC-BY-SA-4.0 license.
Strengths
- Clear CC-BY-SA-4.0 license — safe to read and adapt within its terms
- Ships in trailofbits/skills, an established project with 6,646 GitHub stars
- Works with Claude Code
- Actively maintained — repository updated in the last 90 days
Author
Topics
Frequently asked questions
- What does rust-review do?
- Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.
- How do I install rust-review?
- Run /plugin marketplace add trailofbits/skills in your agent, then reload your skills. Review the source at https://github.com/trailofbits/skills before installing.
- Is rust-review free to use?
- Yes. rust-review is free and open source under the CC-BY-SA-4.0 license, so you can read, run, and adapt it within that license's terms.
- Which agents does rust-review work with?
- rust-review lists Claude Code — named in its SKILL.md, its plugin marketplace or its repository topics. Skills use the portable SKILL.md format, so other agents that read that format may load it too.
- Where does rust-review come from?
- rust-review ships inside trailofbits/skills, a repository that contains 41 catalogued skills in total. The repository's 6,646 GitHub stars apply to that whole collection, not to this skill on its own.
