---
name: "cargo-audit-deny-supply-chain"
description: "Scan Rust crate dependencies for known CVEs, unmaintained packages, and copyleft licenses."
metadata:
  author: "RustSec"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run cargo audit"
  - "configure cargo deny"
  - "check rust crate cve"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Cargo Audit & Cargo Deny Rust Supply Chain Guard

Protects Rust supply chains using cargo-audit and cargo-deny: querying RustSec advisory database, verifying crate licenses, banning duplicate dependency versions, and detecting yanked crates.

## When to Invoke
Invoke this skill whenever you need to:
- run cargo audit
- configure cargo deny
- check rust crate cve

## Execution SOP & Rules
1. Run cargo audit in CI to block pull requests introducing vulnerable crate dependencies.
2. Configure deny.toml with license allowlists and trusted advisory sources.
3. Update vulnerable transitive crates by running cargo update -p <crate_name>.
4. Verify that all installed dependencies are cryptographically signed and unyanked.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.