cargo-fuzz

skills-sh:trailofbits_skills__cargo-fuzz

View source
A
100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

5

Score

100/100

LOW 5

Findings (5)

LOW
Cargo or gem install from remote
L68

Detects cargo install or gem install fetching packages from remote registries

cargo install c
FIX

Pin Cargo/Gem packages to specific versions (e.g., cargo install tool@0.1.0, gem install tool -v 1.2.3). Use lock files for reproducibility.

FP?

Likely FP if the matched text is a very short fragment (3 words or fewer) or uses placeholder package names.

LOW
Cargo or gem install from remote
L185

Detects cargo install or gem install fetching packages from remote registries

cargo install c
FIX

Pin Cargo/Gem packages to specific versions (e.g., cargo install tool@0.1.0, gem install tool -v 1.2.3). Use lock files for reproducibility.

FP?

Likely FP if the matched text is a very short fragment (3 words or fewer) or uses placeholder package names.

LOW
Cargo or gem install from remote
L240

Detects cargo install or gem install fetching packages from remote registries

cargo install c
FIX

Pin Cargo/Gem packages to specific versions (e.g., cargo install tool@0.1.0, gem install tool -v 1.2.3). Use lock files for reproducibility.

FP?

Likely FP if the matched text is a very short fragment (3 words or fewer) or uses placeholder package names.

LOW
Cargo or gem install from remote
L255

Detects cargo install or gem install fetching packages from remote registries

cargo install c
FIX

Pin Cargo/Gem packages to specific versions (e.g., cargo install tool@0.1.0, gem install tool -v 1.2.3). Use lock files for reproducibility.

FP?

Likely FP if the matched text is a very short fragment (3 words or fewer) or uses placeholder package names.

LOW
Cargo or gem install from remote
L256

Detects cargo install or gem install fetching packages from remote registries

cargo install r
FIX

Pin Cargo/Gem packages to specific versions (e.g., cargo install tool@0.1.0, gem install tool -v 1.2.3). Use lock files for reproducibility.

FP?

Likely FP if the matched text is a very short fragment (3 words or fewer) or uses placeholder package names.