# Rust Security Checklist

> Use before merging security-relevant Rust changes. Catches common local-service security regressions. Use when this capability is needed.

- Skill: `tomevault-io/rust-security-checklist` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/rust-security-checklist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/rust-security-checklist/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/rust-security-checklist

---


# rust-security-checklist Skill

Use this skill before merging security-relevant Rust changes.

## Goal

Catch common local-service security regressions early.

## Checklist

1. Input and size limits

- Are request/response/body sizes bounded?
- Are parsing paths resistant to oversized input?

2. Network trust boundaries

- Are remote response sources validated (address/port where required)?
- Are timeouts and retry limits explicit?

3. Resource exhaustion

- Is task/thread concurrency bounded?
- Are unbounded queues/spawns avoided?

4. File and key safety

- Are private keys/certs written with restrictive permissions where supported?
- Are secret file paths stable and predictable under `sudo`?

5. Command execution safety

- Avoid `sh -c` with interpolated strings.
- Prefer direct `Command` APIs and explicit args.

6. Logging hygiene

- No secrets in logs.
- Errors are specific but not sensitive.

## Required Validation

```sh
cargo run -p xtask -- fmt-check
cargo test -q
cargo check --workspace
```

## Reporting Template

- Threat addressed:
- Change summary:
- Residual risk:
- Follow-up (if any):

---
> Source: [Jxck/sptth](https://github.com/Jxck/sptth) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-22 -->