A supply-chain audit tool for Rust projects that records human reviews of third-party crates, which are Rust packages used as dependencies.

It helps initialize audit records, import trusted audit sources, and track reviews in the project's supply-chain directory.

It adds evidence that dependency code was reviewed by your team or a trusted organization, alongside checks for licenses, advisories, and banned packages.

cargo-vet — Skill for Claude Code by sbom-tool

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add sbom-tool/gh-guard --skill cargo-vet

Clone the repo

git clone --depth 1 https://github.com/sbom-tool/gh-guard

Made for: Claude Code.

Or install gh-guard, the plugin that ships this one along with the rest of its 14 skills, 5 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/sbom-tool/gh-guard/cargo-vet/github.svg)](https://agentmods.dev/skills/sbom-tool/gh-guard/cargo-vet)

Your own site

<a href="https://agentmods.dev/skills/sbom-tool/gh-guard/cargo-vet"><img src="https://agentmods.dev/badge/skills/sbom-tool/gh-guard/cargo-vet/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/sbom-tool/gh-guard/cargo-vet"><img src="https://agentmods.dev/badge/skills/sbom-tool/gh-guard/cargo-vet.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 20 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 920 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00020	$0.00920
Opus 5	$0.00010	$0.00460
Sonnet 5	$0.00004	$0.00184
Haiku 4.5	$0.00002	$0.00092

Measured 10d ago against content hash af94f5014d78, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

cargo-vet scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/cargo-vet/SKILL.md · 129 lines

How it starts

The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.

cargo-vet — Supply Chain Audits for Third-Party Crates

cargo-vet ensures third-party dependencies have been audited by you or a trusted organization. It complements cargo-deny (which checks licenses, advisories, bans) by adding human review attestation.

When to Use

Projects that require explicit approval of third-party code
Organizations with compliance requirements for dependency review
Teams wanting to build on audits from trusted peers (Mozilla, Google, etc.)

Setup

# Install
cargo install cargo-vet --locked

# Initialize in your project (creates supply-chain/ directory)
cargo vet init

This creates:

supply-chain/
  audits.toml      # Your audits
  config.toml      # Trusted import sources
  imports.lock     # Cached audits from trusted sources

Configuration

Import trusted audit sources (`config.toml`)

[imports.mozilla]
url = "https://raw.githubusercontent.com/nickel-org/nickel.rs/main/supply-chain/audits.toml"

[imports.google]
url = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/AuditEntry?format=TEXT"

[imports.bytecode-alliance]
url = "https://raw.githubusercontent.com/nickel-org/nickel.rs/main/supply-chain/audits.toml"

Audit criteria

safe-to-deploy — full review, no unsafe/unsound issues, safe for production
safe-to-run — lighter review, safe to build and run tests (not ship)

Workflow

Check audit status

# See what needs auditing
cargo vet

# Suggest audits — shows which crates need review
cargo vet suggest

Record an audit

# After reviewing a crate, record your audit
cargo vet certify CRATE VERSION

# Or record that you trust the delta between versions
cargo vet certify CRATE OLD_VERSION NEW_VERSION

Handle new dependencies

# When adding a new dep, cargo vet will flag it
cargo vet

# Quick exemption for now (audit later)
cargo vet add-exemption CRATE VERSION

CI Integration

Add to CI workflow after the deny check:

Read the full file on GitHub · 129 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 129 lines · 20 tokens per session scan A af94f5014d78

Subscribe to this mod's changes

cargo-vet is a skill published in the GitHub repository sbom-tool/gh-guard (15 stars, last pushed 5mo ago), licensed MIT. It adds 20 tokens to every session and 920 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Languages Rust Security appsec appsec-tools branch-protection secure-by-default supply-chain-security

dd-code-generation

Use pup CLI for immediate Datadog operations or generate code for integration into applications.

DataDog/pup · 16 tokens

omh-rust

This is a Hermes-native rust workflow skill.

rlaope/oh-my-hermes · 69 tokens

bevy-ecs

Structure a Bevy app around its Entity Component System: build the App with plugins, define Component/Resource types, write systems with Query/Res/Commands, filter and order systems, and use the Time resource for frame-rate-independent motion. Use when building or debugging a Bevy game in Rust — when the user mentions…

gamedev-skills/awesome-gamedev-agent-skills · 100 tokens

rust-project

Modern Rust project architecture guide for 2025. Use when creating Rust projects (CLI, web services, libraries). Covers workspace structure, error handling, async patterns, and idiomatic Rust best practices.

majiayu000/spellbook · 43 tokens

gcs-rust-download-object-api

Fix "DownloadObjectRequest not found" error in google-cloud-storage Rust crate. Use when: (1) Trying to download objects from GCS using the Rust SDK, (2) Looking for a download request type in http::objects::download module, (3) Compile error about missing type. The downloadobject method uses GetObjectRequest from the…

divinevideo/divine-mobile · 91 tokens

azure-keyvault-secrets-rust

Client library for Azure Key Vault Secrets — secure storage for passwords, API keys, and other secrets.

benjaminasterA/antigravity-awesome-skills · 0 tokens