SShortSingh.
Back to feed

rustgrade: a fast Rust scanner for anti-patterns that coding agents leave behind

0
·1 views

The author has been using coding agents to write Rust and kept finding recurring problems that compile and pass tests, such as unwrap in library code, std Mutex guards held across awaits, and excessive cloning. To catch these, they built rustgrade, a syn-based scanner with eight rules that needs no LLM, no network access, and no build step. Because it skips type information, it can misjudge some cases, so developers can silence findings inline with a stated reason that remains visible in CI output. The tool runs in about 20 ms on a 445-line file, fast enough to check every agent edit, and it also works standalone in terminals or CI with SARIF output. It integrates as a skill and commands across several AI coding assistants, and was run on 15 well-known open-source crates, which received grades between A and C.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

The Candle: a browser ghost story powered by Gemma 4 and an open-weight model

A developer built The Candle, a browser-based haunted-room game entered in DEV's Hacktoberfest Open-Source AI Challenge, themed "Ghost in the Machine." Players blow into a microphone or hover the cursor to extinguish a candle, after which a ghost answers in the dark. Each of five ghosts has its own voice, backstory, and secret, and players unlock the house's story by picking reply options and questioning the right ghosts. Gemma 4, accessed through Backboard and OpenRouter, generates the ghosts' lines and reply choices, while ElevenLabs provides voices with a Piper fallback. The project is open source under the MIT license, with the code and a live demo available.

0
ProgrammingDEV Community ·

AV1 Moves Closer to Practical Use in WebRTC Real-Time Streaming

Advances in AV1 video codec support have increased interest in its use for WebRTC-based real-time interactive streaming. Google's 2021 Chrome 90 release added an AV1 encoder aimed at low-bitrate video conferencing on modest CPUs, and Cisco began offering live AV1 encoding for shared video clips in Webex. Newer GPUs from Intel, AMD, and Nvidia, released in late 2022, can now handle live AV1 encoding even in fast-action gameplay. The codec promises substantial bitrate savings over H.264 and H.265 and is royalty-free, backed by the Alliance for Open Media. Its heavy computing demands have historically limited live use to low resolutions, a constraint that is now easing.

0
ProgrammingDEV Community ·

Safe Archive Extraction Requires Validating the Final Resolved Path

Extracting archives can overwrite files outside the intended directory through crafted names, absolute paths, or links, a flaw often called Zip Slip. Checking filenames for '..' is insufficient because symlinks and hardlinks, including ones created by earlier members, can redirect writes. Developers should use the safe extraction filters or APIs their language and archive library provide, extract into a fresh, non-shared directory, and recheck the resolved destination after each link operation. Tests should confirm that malicious members are rejected before touching the filesystem, including cases where the destination already contains a symlink, and that size and file-count limits hold. The extractor's default policy should be reviewed and recorded, since defaults can change across releases.

0
ProgrammingDEV Community ·

Developer Builds Claude Code SEO Skill, Finds Two Bugs in First Tests

A developer built a Claude Code skill that audits a single web page for on-page SEO basics such as title, meta description, canonical tags, robots directives, H1, JSON-LD and image alt text. The skill is a folder containing a SKILL.md file and a Python checker that uses only the standard library and outputs JSON for Claude to turn into a prioritized fix list. Its description names the specific checks and trigger conditions so it loads only when relevant, and it forbids claims about ranking impact. Testing on five real pages and one fake page revealed two bugs that surfaced on pages the developer expected to be safe.