Security audit
cargo-mcp
Security checks for vulnerabilities and agentic risk
Overview
This skill clearly documents how to use Cargo's hosted MCP server and related CLI fallback, with the main risks being normal workspace access, credit spend, and third-party action execution that are disclosed and bounded by user checks.
Install only if you intend to let an agent use your Cargo workspace. Before running batches or enrichment actions, confirm the workspace name, expected record count, estimated credits, and whether the data use is permitted for the people or accounts involved.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.