Rust Review

Rust security code review plugin. Bug-class coverage comes from empirical bug-shape research across 245 memory-corruption, 177 unsound safe-API, 150 denial-of-service, and 60 thread-safety advisories in the RustSec Advisory Database (1,078 entries) and audits. Orchestration matches c-review.

Usage

Invoke with /rust-review:rust-review. The skill will prompt for:

• Threat model (REMOTE / LOCAL_UNPRIVILEGED / BOTH)
• Worker model (haiku / sonnet / opus)
• Severity filter (all / medium / high)
• Scope subpath (optional — defaults to whole repo)

Findings + SARIF are written to $(pwd)/.rust-review-results/ /.

Overview

Inputs (AskUserQuestion): threat model, scope subpath (optional), worker model, severity filter.

From these inputs the orchestrator detects Rust capability flags (has_unsafe, has_ffi, has_concurrency, has_async, has_packed_repr, has_fs_io) over the scope and selects clusters from prompts/clusters/manifest.json. Each cluster groups related bug classes anchored on a shared mental model and runs as one parallel worker.

The planner caps each non-consolidated worker at four passes, splitting larger clusters into -1/-2/… chunks; output-heavy clusters can declare a smaller max_passes_per_worker in the manifest (today recursion-dos runs one pass per worker). Consolidated clusters (unsafe-boundary, concurrency-locking) are never chunked — one worker owns the whole cluster so its shared Phase-A inventory is built once and grounds every phase.

Always-on clusters:

• unsafe-boundary (consolidated) — Unsafe Reachability Analysis (URAPI), transmute misuse, pointer-cast hazards via as (PTRCAST), raw-pointer arithmetic, #[repr(C)] layout, enum discriminant and niche validity (ENUMUB), // SAFETY: documentation rules, debug_assert!-guarded safety invariants.
• panic-dos — resource exhaustion DoS (RESEXHAUST, P0), unwrap/expect on untrusted input, arithmetic overflow, reachable unreachable!/assert!, vector OOB indexing, non-char-boundary str slicing panics (STRSLICE), reachable RefCell double-borrow panics (REFCELLPANIC).
• recursion-dos — stack-overflow aborts (uncatchable, distinct from panics) on recursive types: unbounded deserialization depth (serde_yaml/toml/ron/custom Deserialize), recursive Display/Debug/Serialize on attacker-shaped values, implicit Drop of Box -style chains.
• error-handling — discarded Results, panics inside Drop, lossy From/Into and as casts, lossy UTF-8 / OS-string / path conversions (LOSSYSTR), unflushed BufWriter swallowing write errors (BUFFLUSH).
• logic-correctness — Ord/Eq/Hash invariant violations, hostile generic trait impls, closure-panic across unsafe scaffolding, NaN/Inf edge cases, partial-match/case string comparisons (STRCMP), serialize_struct field-count mismatches (SERFIELDS), nondeterminism in replicated state (NONDET), in-collection key mutation (KEYMUT). The hostile-trait (TRAITADV) and closure-panic (CLOSUREPANIC) passes require has_unsafe.
• static-hygiene — Cargo lint config, MSRV, deprecated APIs (mem::uninitialized).
• resource-handling — raw file-descriptor double-close and leak (RAWFD), Drop-skipping cleanup via process::exit/mem::forget (DROPSKIP).
• info-disclosure — pointer/address exposure that defeats ASLR (PTREXPOSE).

Conditional clusters:

• memory-safety (has_unsafe) — UAF via dangled raw pointer, double-free via ptr::read, invalid-free via assignment-to-uninit, uninitialized-read via premature assume_init, Vec::set_len without slot init (SETLEN), buffer overflow via safe→unsafe index propagation, union variant misread, panic-unsafe custom container drop (PANICUNWIND). The whole cluster is gated on has_unsafe (every memory-safety bug class requires unsafe), so it is omitted entirely for pure safe-Rust crates.
• concurrency-locking (has_concurrency, consolidated) — MutexGuard double-lock from lexical scope, ABBA ordering, Condvar wait without notifier, channel starvation, Once::call_once reentrancy, signal-handler / callback reentrancy.
• concurrency-data-race (has_concurrency) — non-atomic atomic sequences, unsafe impl Sync over interior mutability, missing Send/Sync bounds, cross-process shared-memory races, unsynchronized static mut (STATICMUT). The unsafe-sync-impl (UNSAFESYNC) and static-mut (STATICMUT) passes require has_unsafe.
• ffi-cross-language (has_ffi) — CString::as_ptr dangling, ABI mismatch, #[repr(C)] padding leak, opaque-pointer ownership confusion, FFI-owned-memory drop mismatches, Rust closures across extern "C" without catch_unwind, dyn Trait fat pointers crossing FFI.