From ceej-skills
Use when the user asks for a holistic / wholistic review of a Rust project, "is this codebase healthy", "review the project", "audit before sharing", or at a periodic checkpoint in a personal Rust project
How this skill is triggered — by the user, by Claude, or both
Slash command
/ceej-skills:rust-project-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A holistic pass over a Rust codebase: first general code-quality concerns that apply to any project, then Rust-specific hygiene. The output should be concrete enough to act on — file references, not vibes.
A holistic pass over a Rust codebase: first general code-quality concerns that apply to any project, then Rust-specific hygiene. The output should be concrete enough to act on — file references, not vibes.
Core principle: every finding cites a file and a reason. "The architecture could be cleaner" is not a finding; "src/lib.rs:42 re-exports internal::Inner which is referenced in three other modules — exposing this as pub use internal::Inner would let callers stop reaching through" is.
cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test, cargo doc --no-deps — record what's clean and what isn't.Findings should land in a single message. Don't fix anything in this pass — review only. Fixes come after the user picks priorities.
main.rs / lib.rs alone?Cargo.toml snippet and a minimal call site?/// doc comments?cargo test --doc)?NonEmpty<T>?#[allow(dead_code)], commented-out blocks, orphaned files)?dbg!, eprintln!, debug-only branches?Cargo.toml?UserId(u64), Millis(u64), Email(String)).NonZeroU32, NonZeroUsize, NonEmpty<T>, OnceCell / OnceLock used where they fit.Builder<Unconfigured> → Builder<Ready> → Built).thiserror-style enums per module or per crate; variants describe failure modes, not just sources.anyhow or miette are fine; their Context extension is used to add per-call context.Box<dyn Error> in public APIs.impl std::error::Error chains source errors via #[source] / #[from]..unwrap() and .expect() confined to:
main returning Result from ? (fine)arr[i]) with bounds-checked alternatives where practical (get, chunks, windows).for i in 0..n loops where natural.? over manual match on Result/Option.if let, let else, let .. else { return } where they cut nesting.From / Into impls for ergonomic conversions; TryFrom where conversion can fail.Default impls where there's a sensible default.#[must_use] on builders, query results, and types where ignoring the value is a bug.Display and Debug thoughtfully chosen — Debug derived, Display hand-written for user-facing output..clone() and .to_string() justified — could it be a borrow, a move, or a Cow<'_, T>?'static where it shouldn't be.pub is intentional, not just "the compiler asked for it".pub(crate) / pub(super) used to scope visibility.pub use build a clean public façade — callers shouldn't need to know about internal::deeply::nested::Type.mod.rs vs name.rs + name/ — consistent across the project.block_on deep in the call stack.Send + 'static bounds present only where the runtime requires them..await points (no half-mutated state if the future drops mid-way).cargo fmt --check clean.cargo clippy --all-targets --all-features -- -D warnings clean. No broad #[allow(clippy::...)] without a comment justifying it.cargo test clean, including doctests.cargo doc --no-deps warning-free.cargo audit reviewed — informational while hacking privately, but blocking before a public release or crates.io publish.cargo deny check (advisories + bans + licenses + duplicate versions) as the one-command supply-chain gate, if the project has any dependencies worth gating.Cargo.toml hygiene[dev-dependencies] separate from [dependencies].rust-version = "1.74").cargo machete or cargo udeps).[profile.release] settings if performance matters.unsafeunsafe block has a // SAFETY: comment justifying the invariants.unsafe is the target..env. Secrets don't leak through a derived Debug impl.unsafe transmute of attacker-controlled bytes.cargo audit for RUSTSEC advisories and cargo deny check for licenses + bans + duplicate versions (see Tooling). Eyeball Cargo.lock churn for unexpected new transitive deps, and watch for typosquatted crate names when something was recently added..unwrap() or index panic is a denial-of-service vector, not just a style nit (ties back to No casual panics).This is the holistic-review touch on security. For a focused pass — threat model, injection, authz, crypto, PHI handling, panics-as-DoS, supply chain — use the
rust-security-reviewskill.
Dependency-audit output shape. When cargo audit / cargo deny surface anything, don't bury
it in prose — emit a compact table so the fix path is obvious:
| Advisory / issue | Crate @ version | Severity | Reachable? | Fix |
|--------------------|-----------------|----------|-----------------------|---------------------------|
| RUSTSEC-YYYY-NNNN | foo @ 1.2.3 | High | yes — live path <loc> | bump to 1.2.4 |
| license: GPL-3.0 | bar @ 0.4 | — | transitive via baz | replace baz / allow in deny.toml |
"Reachable?" is the column that matters: an advisory in a dev-only or unreached dependency ranks
below one on a live code path. Note unexpected Cargo.lock churn in the same place.
End the review with:
Strengths
1. ...
2. ...
3. ...
Issues (in priority order)
1. ... (file:line) — why this matters
2. ...
3. ...
Recommended next action
...
The "Recommended next action" should be a single concrete first step, not a plan. The user picks from the issue list and we work down it together.
| Don't | Why |
|---|---|
| Vague findings ("could be cleaner") | Useless without a file reference and a reason. |
| Ten "issues" of equal weight | Forces the user to do the prioritization. Top 3, then a long-tail list if needed. |
| Recommend rewrites | This is a review pass, not a redesign. Suggest the smallest move that improves the situation. |
| Score the project on a numeric scale | Numbers feel rigorous and aren't. Specific findings are more useful. |
| Skip Section A because it's "general" | The general issues are usually the ones that matter most. Don't only nitpick clippy lints. |
Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub ceejbot/ceej-skills --plugin ceej-skills