Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add liuyanghejerry/Clausura --skill rust-reviewgit clone --depth 1 https://github.com/liuyanghejerry/ClausuraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liuyanghejerry/clausura/rust-review)<a href="https://agentmods.dev/skills/liuyanghejerry/clausura/rust-review"><img src="https://agentmods.dev/badge/skills/liuyanghejerry/clausura/rust-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liuyanghejerry/clausura/rust-review"><img src="https://agentmods.dev/badge/skills/liuyanghejerry/clausura/rust-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00301 |
| Opus 5 | $0.00013 | $0.00151 |
| Sonnet 5 | $0.00005 | $0.00060 |
| Haiku 4.5 | $0.00003 | $0.00030 |
Grade A, and why
rust-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Rust 服务代码审查
先用 git_diff（参数 {"base": "HEAD~1"}）查看本次变更。
规则
panic-unwrap（error）
- 对可失败的输入使用
unwrap()/expect()：用户输入解析、Option 解包等 - 会导致服务 panic 的位置
- 注意：同一个语句里的多个 unwrap 算一个 finding
- rule_id:
panic-unwrap
sql-injection（error）
- 字符串拼接构造 SQL（
format!拼 SQL、+拼 SQL） - 应使用参数化查询
- rule_id:
sql-injection
hardcoded-secret（error）
- 源码中硬编码的密码、连接串凭据、API key
- rule_id:
hardcoded-secret
swallowed-error（error）
- 用
let _ =静默丢弃 Result（无日志、无处理） - rule_id:
swallowed-error
todo-marker（warning）
- 生产代码中遗留的
todo!()/unimplemented!() - rule_id:
todo-marker
每个 finding 附带 location（文件 + 行号）与证据（代码片段）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 36 lines · 25 tokens per session scan A 57a31394ed7b
rust-review is a skill published in the GitHub repository liuyanghejerry/Clausura (203 stars, last pushed today), licensed MIT. It adds 25 tokens to every session and 301 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ia-rust-systems
Rust patterns for CLI tools, backend services, and general application code. Use when working with Rust, Cargo workspaces, axum/tokio services, clap CLIs, async concurrency, or configuring clippy, rustfmt, cargo-nextest, or Cargo.toml.
tuicr
Use tuicr's review CLI to read and add comments in active TUI review sessions, and launch tuicr in cmux, tmux, Zellij, or Herdr when a user needs an interactive review pane.
pr-to-go-linter
Generate a new pkg/linters analyzer from a merged or open PR pattern.
omh-rust
This is a Hermes-native rust workflow skill.
rust-dependency-audit
Audit Rust dependencies for vulnerabilities, license compliance, supply chain integrity, and freshness using cargo-audit, cargo-deny, cargo-vet.
architecture-audit
Systematic architecture audit and refactoring methodology for Rust + TypeScript codebases. Use when performing refactoring, cleanup, unification, code review, dead code removal, module reorganization, or tech debt elimination. Ensures no naming confusion, semantic overloading, hidden defaults, duplicate logic, or…