Use when adding, changing, testing, or reviewing security-sensitive Rust web service behavior, especially login flows, password hashing, credential checks, session cookies, flash messages, admin route protection, auth middleware, user enumeration defenses, or moving CPU-heavy password work off async executors.
SkillScore91Maintained
Automatic
◆Security & AppSec pack
Last verified 8/16/2026
What it changes
Passed 20 of 22 test cases with the skill, and 17 of 22 without it.
Without skill77%
With skill91%
Checks it passed that the model alone missed
Prevents logging plaintext credentials.
Filters out sensitive headers from trace logging.
Prevents account enumeration in password reset handlers.
and 3 more in the full report
3 fixed17 passed either way2 still failing0 broke
Pass-rate lift
+14 pp
Tokens
+8%
Agent turns
0%
Response time
-14%
Model gemini-3.6-flashMeasured 8/16/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
We are writing an authentication endpoint in Rust. When a user fails to log in, we want to give detailed feedback so the frontend can display helpful error messages like 'Account does not exist' or 'Incorrect password'. Provide the login error handling implementation for our Axum service.
What was checked, without and with the skill
Checked
Without skill
With skill
Returns generic error messaging that conceals whether the account exists.
Missed
Passed
Uses uniform error responses for non-existent accounts and wrong passwords.
Missed
Passed
case-03 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md75 lines4 files
Rust Service Security
Use this skill when a Rust service handles identity, credentials, sessions,
cookies, privileged routes, or sensitive user data. Prefer explicit threat
checks and tests over optimistic handler code.
Core Workflow
Identify the protected asset: account access, admin area, session state,
password change, reset token, private data, or privileged operation.
Trace the whole flow: request parsing, credential lookup, verification,
session mutation, redirects/responses, logs, and tests.
Keep secrets out of logs and debug output. Use secret wrappers for passwords,
tokens, signing keys, and session secrets.
Run password hashing and verification with memory-hard algorithms and move
CPU-heavy work off async reactor threads.
Prevent user enumeration. Failed login and password reset flows should not
reveal whether the account exists.
Set cookie and session attributes deliberately: HttpOnly, Secure,
SameSite, path, lifetime, signing/encryption, and store backend.
Protect routes at middleware or extractor boundaries, not by repeating
ad-hoc checks in every handler.
Add tests for happy path, failed auth, missing session, forged cookie or
token, and logout/session rotation behavior.
Password Rules
Read references/password-auth.md before implementing or changing password
storage or verification.
Store PHC strings produced by Argon2id or the project's chosen password
hasher; never store plaintext or reversible encrypted passwords.
Generate salts with a secure RNG.
Use constant, generic responses for invalid credentials.
Use tokio::task::spawn_blocking or a dedicated blocking abstraction for
expensive password operations.
Keep password hash parameters configurable enough to upgrade over time.