rust-securitylisted

# Rust Supply Chain Security ## Purpose Use this skill for Rust supply chain security and untrusted-input hardening. It covers vulnerability scanning with `cargo-audit`, policy enforcement with `cargo-deny`, RUSTSEC advisory triage, new-crate risk evaluation, and parser hardening for files that come from outside your trust boundary. For memory-safety validation, see the `rust-sanitizers-miri` skill. For unsafe code audits, see the `rust-unsafe` skill. For lockfile and workspace mechanics, see the `cargo-workflows` skill. ## Triggers - "How do I check my Rust dependencies for CVEs?" - "How do I use cargo-audit or cargo-deny?" - "How do I enforce dependency policy in CI?" - "What is the RUSTSEC advisory database?" - "A dependency has a security advisory. What do I do?" - "Is it safe to add this crate?" - "Is it safe to parse this file from user input?" - "How do I validate an archive or backup file before import?" ## Orientation Before you change anything, collect these facts about the workspace: 1. The workspace manifest path. Every command below takes `--manifest-path <workspace>/Cargo.toml` when you do not run it from the workspace root. 2. The policy config path. `cargo-deny` reads `deny.toml` next to the manifest unless you pass `--config`. 3. The package count and the dependency graph: `cargo metadata --locked --no-deps` for workspace members, `cargo tree --locked` for the full graph. 4. The CI job that runs the policy check, and the exact tool vers