Borrowing it
Nothing to install: this file belongs to arthjean/rust-doctor. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/arthjean/rust-doctor/main/.claude/skills/rule-candidate/SKILL.mdgit clone --depth 1 https://github.com/arthjean/rust-doctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arthjean/rust-doctor/rule-candidate)<a href="https://agentmods.dev/skills/arthjean/rust-doctor/rule-candidate"><img src="https://agentmods.dev/badge/skills/arthjean/rust-doctor/rule-candidate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arthjean/rust-doctor/rule-candidate"><img src="https://agentmods.dev/badge/skills/arthjean/rust-doctor/rule-candidate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 40 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.01417 |
| Opus 5 | $0.00049 | $0.00709 |
| Sonnet 5 | $0.00020 | $0.00283 |
| Haiku 4.5 | $0.00010 | $0.00142 |
Grade A, and why
rule-candidate scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sSL -o clippy.tar.gz \ How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Triage a batch of candidate lints
The upstream side of this catalog is finite: clippy-driver -W help enumerates
every lint of the toolchain. Triage walks that list in batches and turns each
lint into one of three states. Nothing here edits the catalog; retaining a lint
only hands it to rule-admit.
Read the "Admitting a rule" and "The candidate queue" sections of
docs/catalog-and-corpus.md before starting.
Step 1: Read the queue
cargo test --lib policy::coverage -- --nocapture
The run prints universe N, decided N, queue N and then the queue itself, one
lint per line as level, id, groups. Take the batch off the top unless the
user named a theme. The head is the warned lints, and that order is deliberate:
they already reach the user's report uncatalogued, with no category, no tier and
no help, and they cost the score its authoritative flag.
Default batch size is 20. Announce the batch before working it.
Step 2: Decide each lint
Fetch what the lint actually does. The toolchain carries the one-line
description, and the rationale lives in the lint declaration itself, never in
memory. The published lints.json no longer resolves, so read the source: pull
the Clippy tree once per session into a scratch directory and extract every
declare_clippy_lint! doc comment, which gives "What it does", "Why is this
bad?" and "Known problems" for all lints at once.
curl -sSL -o clippy.tar.gz \
https://github.com/rust-lang/rust-clippy/archive/refs/heads/master.tar.gz
tar xzf clippy.tar.gz --strip-components=1 --wildcards "*/clippy_lints/src/*"
That tree is master, not the pinned toolchain. The wording of a stable lint
rarely moves, but check the toolchain's own one-line description when the two
seem to disagree.
Three outcomes, and only two of them are edits.
Reject when the lint should never ship, for a reason that holds whatever
workspace is scanned. Append to src/policy/rejected.json, sorted by id, with a
closed class and one written sentence ending in a period:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 133 lines · 99 tokens per session scan A 98d173534752
rule-candidate is a skill published in the GitHub repository arthjean/rust-doctor (18 stars, last pushed 2d ago), licensed Apache-2.0. It adds 99 tokens to every session and 1,417 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rust-check
Run cargo check on the current Rust project to find compile errors.
ast-grep
Use for ast-grep project setup, rule authoring, rule debugging, and structural search workflows.
rust-build-optimization
Use when a Rust or Cargo build is slow and the user wants it diagnosed or sped up: profiling compile times with cargo --timings or -Zself-profile, finding whether the bottleneck is dependencies, codegen/LLVM, linking, or one oversized crate, and applying targeted fixes such as faster linkers (lld, mold, wild)…
rust-quality-gate
PM-invocable protocol for running and interpreting Rust quality gates in the trusty-tools monorepo: fmt, clippy, and test in strict sequence before any merge.
rust-patterns
Idiomatic Rust patterns, ownership, error handling, traits, concurrency, and best practices for building safe, performant applications.
debug
Reproduce, minimize, localize, identify root cause, and distinguish diagnosis from an authorized fix. Prefer root-cause over symptom patches.