Borrowing it
Nothing to install: this file belongs to tsz-org/tsz. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/tsz-org/tsz/main/.agents/skills/rust-hygiene-audit/SKILL.mdgit clone --depth 1 https://github.com/tsz-org/tszWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tsz-org/tsz/rust-hygiene-audit)<a href="https://agentmods.dev/skills/tsz-org/tsz/rust-hygiene-audit"><img src="https://agentmods.dev/badge/skills/tsz-org/tsz/rust-hygiene-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tsz-org/tsz/rust-hygiene-audit"><img src="https://agentmods.dev/badge/skills/tsz-org/tsz/rust-hygiene-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00157 | $0.01485 |
| Opus 5.5 | $0.00063 | $0.00594 |
| Sonnet 5.5 | $0.00031 | $0.00297 |
| Haiku 4.5 | $0.00016 | $0.00148 |
Grade A, and why
rust-hygiene-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rust Hygiene Audit
Turn a fuzzy "clean up the codebase" request into a set of evidence-backed,
deduplicated, parent/child GitHub issues — without flooding the tracker with
smells. The guiding principle: every issue must cite real file:line evidence
that survived an adversarial check, and must not duplicate an open issue.
This skill is for hygiene/DRY/lint work, not behavior changes. It produces
issues and field assignments; it does not edit compiler logic. Keep parity work
(tsc matching) in the owner skills.
The four phases
Run them in order. Phases 1–2 are analysis; 3–4 are writes — confirm scope with the user before mass-creating issues unless they already said "create them".
1. Measure the Clippy posture (prevention evidence)
The cheapest lever against future debt is a tighter lint floor, so quantify what the current floor lets through before proposing changes.
python3 .agents/skills/rust-hygiene-audit/scripts/measure_clippy.py --worktree . --out /tmp/hygiene
This runs cargo clippy --workspace --lib -- -W clippy::pedantic -W clippy::nursery
(no files touched), aggregates warnings per lint, and prints a promote vs
defer triage. Read references/lint-triage.md for the rationale behind which
lints are worth promoting in a compiler (numeric casts and must_use/doc
pedantry are mostly intentional; idiom/ownership lints are high-signal). The
count and triage become the body of the clippy-posture epic.
Disk note: a cold workspace clippy build needs ~8–12GB. If low, reclaim merged
worktree caches first (see tsz-disk-cache-hygiene).
2. Fan out the audit (find + verify)
Drive the bundled workflow, which fans out per-crate DRY auditors and cross-cutting concern auditors, dedups against open issues, then adversarially verifies every candidate against the real source before authoring full issue bodies:
Workflow({ scriptPath: "scripts/agents/hygiene-audit-workflow.mjs" })
Before launching, snapshot the open issues the auditors dedup against:
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago First seen · 120 lines · 157 tokens per session scan A e53792190c45
rust-hygiene-audit is a skill published in the GitHub repository tsz-org/tsz (577 stars, last pushed today), licensed Apache-2.0. It adds 157 tokens to every session and 1,485 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-28.
Other skills, from other repositories
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.
review
Diff-scoped correctness review that reads the codebase around the change — callers, contracts, and invariants — and returns line-anchored findings ranked by severity with confidence, then a merge-risk verdict. Use for reviewing a PR, diff, or named change set. Not for style review, approvals-as-rubber-stamp, or…
code-review
Run a final code review on a pull request.
code-breaking-changes
Search for breaking changes in external integration surfaces.
tuicr
Use tuicr's review CLI to read and add comments in active TUI review sessions, and launch tuicr in cmux, tmux, Zellij, or Herdr when a user needs an interactive review pane.
architecture-audit
Systematic architecture audit and refactoring methodology for Rust + TypeScript codebases. Use when performing refactoring, cleanup, unification, code review, dead code removal, module reorganization, or tech debt elimination. Ensures no naming confusion, semantic overloading, hidden defaults, duplicate logic, or…