ClawHub
Back to skill

Security audit

cargo-content

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Cargo workspace content-management skill, with the main caution that its remove commands can delete knowledge resources.

Before installing, understand that this skill helps agents run Cargo CLI commands against your Cargo workspace. Verify file and library UUIDs before using remove commands, and be careful when uploading or syncing documents because they may contain private business or customer information.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The markdown instructs users to remove files with `cargo-ai content file remove <file-uuid>` but does not warn that this deletes workspace knowledge content. Under the markdown criteria, destructive operations that could affect user data should include a warning about impact or irreversibility.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill shows `cargo-ai content library remove <library-uuid>` with no adjacent warning about removing a knowledge library. Because this is a destructive operation on user-managed resources, the markdown should disclose the effect on attached or dependent agent configurations.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The markdown includes a direct example for removing a file with `cargo-ai content file remove <file-uuid>` but provides no user-facing warning that the action deletes content or may be irreversible. Under the markdown criteria, descriptions should warn about behaviors that could affect user data or system integrity.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The file shows `cargo-ai content library remove <library-uuid>` as part of update/remove examples without explaining that it is a destructive operation affecting configured resources. The markdown guidance does not disclose the potential impact on user data or connected agent/library behavior.

Static analysis

No suspicious patterns detected.