Omar SobhandClaude Opus 4.7
7b23f61632
Hand-authored skill catalog anchored to real 2026-07 versions:
- Rust 1.97.1 (stable), edition 2024
- React 19.2.7, Server Components + Actions
- TailwindCSS 4.3.3 (CSS-first config, Oxide engine)
- three.js r185 (WebGPURenderer stable, BatchedMesh matured)
- React Native 0.86 / Expo SDK 54+ (New Architecture default)
- cargo-nextest 0.9.140, gitleaks 8.20+, cargo-audit 0.21+
- Postgres 17 (18 in beta, don't rely on)
- CUDA Blackwell, Metal Apple7+, ROCm CDNA3
Ships 15 skills across the categories:
foundation/ workspace-repo-commit-protocol
small-focused-commits
tdd-red-green-refactor
code-review-checklist
int-xx-marker-protocol
decompose-int-items
rust/ write-rust-current-edition
rust-error-handling
cargo-test-driven-development
rust-async-tokio-idioms
backend/ postgres-migrations-forward-only
postgres-index-selection
api-pagination-day-1
frontend/ react-19-server-components
tailwind-v4-idioms
component-4-state-model
mobile/ expo-managed-vs-bare
rn-flashlist-perf
gpu/ gpu-coalescing-and-occupancy
roofline-model
threejs/ threejs-perf-and-teardown
security/ cargo-audit-workflow
secret-scanning-gitleaks
skills_loader.rs walks skills/**/*.md, parses YAML frontmatter
(name, description, when_to_use, tags), upserts via
skills_catalog::upsert_builtin. Idempotent per boot — bumps version
+ appends skill_versions row ONLY when body changes. Deterministic
sha256-derived ids so builtins are stable across boots.
Dockerfile copies skills/ to /etc/clawmates/skills. Server boot
task spawns loader alongside team_template_loader.
Follow-ups (Slice 3.5c continuation, future PRs):
- 20-30 more skills (duckdb, shadcn composition, a11y, WebGPU
migration, metal frame capture, rocprof, deep gitea forge
integration, semgrep rulepacks)
- Bind skills to team template roles (add [role.skills] refs to
templates/teams/*.toml + wire template_role_skills population
in team_template_loader)
Co-Authored-By: Claude Opus 4.7 <[email protected]>
2.9 KiB
2.9 KiB
name: cargo-audit-workflow
description: cargo-audit (rustsec) — how to run it, triage findings, and integrate into the security template's mission flow.
when_to_use: You're on a security mission or investigating a RUSTSEC advisory in a Rust project.
tags: [security, rust, versioned]
cargo-audit workflow
Anchored to cargo-audit 0.21+ (2026 line) reading the RustSec Advisory DB.
Basic usage
cargo install cargo-audit --locked
cargo audit # scans Cargo.lock, reports vulnerabilities
cargo audit fetch # update advisory DB
cargo audit --deny warnings # non-zero on any warning too (yanked crates, unmaintained)
CI runs: cargo audit --deny warnings --json — JSON output goes to the mission's mission_artifacts as a security_report.
Triage each finding
For every advisory the report surfaces:
-
Is the vulnerable path reachable from OUR code?
cargo tree -i <cratename>shows who depends on it.- Sometimes a vulnerable transitive dep is only exercised by a feature you don't enable — check the report's
affected_functions.
-
What versions fix it?
- The advisory lists
patched_versions. Trycargo update -p <crate> --precise <version>to hop to a patched minor without a semver-major bump. - If patched only in a newer major, plan the migration (may be a multi-INT effort).
- The advisory lists
-
Is there a
RUSTSECallowlist for a known-false-positive?[advisories.ignore]inaudit.toml— with a comment explaining WHY and a ticket link + expiry date.- Never ignore without expiry; reviewers should re-evaluate quarterly.
Common findings + fixes
RUSTSEC-YYYY-NNNNon a dev-dep: less urgent, but fix anyway — dev tools run in CI with elevated permissions.- Yanked crate — the version was pulled from crates.io. Update immediately;
cargo update -p <crate>picks the next non-yanked. - Unmaintained crate warning — no CVE yet, but the maintainer walked away. Long-term: replace. Short-term: pin and document.
Integration with the security mission template
The security-hardening mission runs cargo audit --json in the security_scan phase. Each finding becomes a mission_task with:
external_id = "RUSTSEC-YYYY-NNNN"title = advisory.titlestatus = "created"
The coding phase picks up each finding as an INT-XX item and applies the fix (bump, replace, or add ignore-with-justification). Emit COMPLETED: RUSTSEC-YYYY-NNNN when the follow-up commit lands.
Anti-patterns
- Silencing an advisory in CI without a fix commit. Advisories aren't a code style violation — they're a claim your code is exposed. Fix or explicitly accept.
- Bumping to a beta version to "fix" it. Betas can regress. Prefer a patched stable; if none exists, wait or fork.
- Running
cargo auditonly in CI, never locally. Every commit that changes Cargo.lock should trigger a local run.