Guides Rust dependency supply-chain risk triage during PR and release reviews.
npx skills add https://github.com/Pandaala/Edgion --skill supply-chain-review
Please help me install this Agent Skill. Skill: supply-chain-review Source: https://github.com/Pandaala/Edgion/tree/main/skills/04-review/supply-chain Command: npx skills add https://github.com/Pandaala/Edgion --skill supply-chain-review
Supply-chain reviews prevent insecure or incompatible Rust dependencies from entering Edgion by standardizing how to audit lockfile changes, new crates, MSRV impacts, and license risk.
cargo audit and cargo deny, plus when to do manual lockfile diffs.Use the supply-chain-review skill when reviewing a PR that modifies Cargo.lock, adds new crates, updates MSRV-related metadata, or introduces a dependency licensing concern so you can document the decision using the triage rules in this directory.
High-intent search queries and answers about installing and using this skill.
To triage Rust dependency risks during PR review, audit lockfile changes by running cargo audit for RUSTSEC advisories and cargo deny for license compliance, then document severity-based merge decisions for malicious upstream or transitive vulnerabilities.
The best way to enforce license compliance before release is to run cargo deny to check for copyleft or non-commercial licenses, document acceptance decisions for maintenance-mode crates, and block merges if high-severity license violations are found.
To handle MSRV drift when updating Rust dependencies, evaluate MSRV-related metadata changes in the PR, determine if the new Minimum Supported Rust Version impacts project compatibility, and document the acceptance decision using established triage rules.
Yes, cargo audit identifies RUSTSEC advisories that often flag abandoned or maintenance-mode Rust crates, allowing you to apply severity-based actions and document re-evaluation triggers in-repo for acceptance.
You should manually diff Cargo.lock when reviewing PRs that add new crates or update dependencies, as manual inspection complements cargo audit and cargo deny by catching malicious upstream risk and transitive vulnerabilities not yet listed in advisories.
mitchellvandusen-cellAudit Python dependencies for CVEs, outdated packages, licenses, and unused imports.
korchasaAutomate final pull request review and merge in an SDLC pipeline.
kivo360Validate TRUST 5-principles compliance and quality gates across multi-language projects.
Logos-LiberIdentifies security vulnerabilities in code, dependencies, and container images.