skills.rest
fedixyz
fedixyzOFFICIAL
Explore all skills by this author →
GitHub

github-cargo-dependabot-review

Review Dependabot PRs updating Rust crates via security-focused crates.io tarball diffs.

78|27|Updated May 4, 2024
Search Tags:#code review#github#rust#cargo#supply chain security#dependabot#crates.io
One-click install
npx skills add https://github.com/fedixyz/fedi --skill github-cargo-dependabot-review-fedixyz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: github-cargo-dependabot-review
Source: https://github.com/fedixyz/fedi/tree/main/.agents/skills/github-cargo-dependabot-review
Command: npx skills add https://github.com/fedixyz/fedi --skill github-cargo-dependabot-review-fedixyz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Dependabot PRs that bump Rust dependencies can silently introduce supply-chain risks such as malicious build scripts, new unsafe code, or yanked releases, and manually diffing every crate update is slow and error-prone. ## Core Features & Use Cases - Security-focused tarball diffing: Downloads both published crates.io tarballs, verifies SHA-256 checksums against crates.io metadata, and diffs the full source between versions. - Multi-dependency coordination: Splits large Dependabot PRs into per-dependency review units, delegates each to a sub-agent, and posts a roll-up merge recommendation. - Structured review comments: Posts evidence-backed PR comments covering checksums, release age, yanked status, risky code changes, and a clear OK to merge / not OK to merge verdict. - Use Case: A Dependabot PR bumps three crates in Cargo.lock; the Skill reviews each crate's tarball diff for new build.rs logic, unsafe code, or network access, then posts per-crate comments and a final merge recommendation. ## Quick Start Review the open Dependabot PRs in this repository that update Cargo dependencies and post a security review comment on each one.

Frequently Asked Questions about github-cargo-dependabot-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review Dependabot PRs for Rust Cargo dependencies?▼

Review Dependabot Cargo PRs by extracting every changed crate from the PR body and Cargo.lock diff, then downloading both published crates.io tarballs and diffing them. Verify checksums against crates.io metadata and post a per-dependency comment with an OK to merge or not OK to merge recommendation.

How to check if a crates.io update is safe to merge?▼

Check a crates.io update by verifying the tarball SHA-256 matches crates.io metadata, confirming the release is not yanked and is older than one week, and diffing the source for new build scripts, unsafe code, network access, or credential handling. Compare the diff against the changelog and release notes.

What security risks should I look for in Rust dependency updates?▼

Look for new or changed build.rs files, proc-macro code, FFI or links metadata, new unsafe or transmute usage, process spawning, environment-variable harvesting, network access, binary blobs, and license or repository ownership changes. Also check transitive dependencies for new crypto, networking, or obscure crates.

How are multi-dependency Dependabot PRs handled?▼

Multi-dependency PRs are split into separate review units, one per direct crate bump or lockfile-only update. Each unit gets its own delegated review and comment, and a final roll-up comment recommends merging only if every unit was reviewed and marked OK to merge.

Does the review skip PRs that were already reviewed?▼

Yes, the review first checks existing PR comments for a prior whole-PR or dependency-specific review by the same user or named bot accounts. If a complete review with a merge recommendation already exists, that PR or dependency unit is skipped and reported as already reviewed.

Related Skills

Explore More Software Engineering Skills→
Evolutionary-LeadershipEvolutionary-Leadership

deps

Review and batch-merge Dependabot pull requests grouped by risk level.

Official
Intermediate
alceupassosalceupassos

version-release

Automate software releases with Git tags, GitHub Release APIs, and version bumping.

Community
Advanced
ruvnetruvnet
70.1k

dependency-check

Scans project dependencies for known CVEs and outdated packages.

Community
Basic
kreuzberg-devkreuzberg-dev
836

Security & Vulnerability Management

Audit dependencies and review unsafe code for software security.

Official
Advanced