rust-api-reviewer_skill

Overview

This skill reviews Rust web APIs built with Actix-web, Axum, or Rocket, focusing on async patterns, extractors, state, error responses, and Tower middleware. It highlights high-risk anti-patterns and provides concrete recommendations to improve safety, performance, and maintainability. Use it when you need a targeted API design and runtime review rather than a general Rust audit.

How this skill works

The reviewer scans project manifests and common directories to detect framework usage and middleware (e.g., actix-web, axum, rocket, tower). It inspects async handlers, extractor usage and ordering, state management patterns, error types and IntoResponse implementations, and middleware composition. Findings are reported with severity levels and actionable fixes like nesting routes, using Json/ValidatedJson, replacing blocking Mutexes, and centralizing auth in middleware.

When to use it

• Conducting a Rust REST API code review
• Auditing Actix-web / Axum / Rocket projects
• Checking async handler patterns and extractor ordering
• Validating state and connection-pool usage
• Reviewing error handling and middleware (tower)

Best practices

• Use typed extractors and ensure body-consuming extractors are last
• Organize routes by resource and use Router::nest or web::scope
• Keep AppState cloneable and async-safe; avoid std::sync::Mutex in async code
• Implement a custom error type with IntoResponse and map internal errors to safe HTTP responses
• Apply tower middleware layers for tracing, timeouts, CORS, and auth

Example use cases

• Find and fix manual JSON parsing by replacing it with Json or ValidatedJson
• Detect std::sync::Mutex or global statics and recommend tokio::sync locks or injected state
• Identify missing IntoResponse implementations and suggest an error mapping strategy
• Recommend breaking up large main route lists into nested routers or scopes
• Suggest middleware extraction for auth, tracing, and timeouts to simplify handlers