Security audit

cargo-orchestration

Security checks across malware telemetry and agentic risk

Overview

This Cargo skill is not malicious, but it needs Review because it documents powerful workflow, batch, segment, file, CRM, and webhook operations without consistently warning or gating users.

Install only if you intend to let the agent operate a Cargo workspace with real orchestration authority. Use a test workspace or least-privilege account where possible, verify every workflow/segment/connector UUID, confirm cost before large batches, avoid uploading sensitive files unless approved, store webhook secrets outside shell history, and require explicit confirmation before deploy, cancel, segment removal, CRM write, or external webhook operations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill metadata and description frame this as an orchestration/querying utility, but the body exposes many state-changing operations: creating runs/batches/messages, cancelling runs/batches/records, updating/removing segments, and uploading files. This capability mismatch can mislead higher-level policy or users into invoking destructive or billable actions under a skill that appears primarily observational, increasing the risk of unauthorized mutation, spend, or disruption.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Segment update and removal are administrative data-management actions that extend beyond the stated orchestration/runtime scope. Including them in this skill broadens privilege unexpectedly, so an agent selecting this skill for runtime inspection could also gain access to modify or delete segmentation assets, causing operational errors or data loss.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documented `workspaceManagement file upload` and `file list-columns` commands expand the skill beyond its declared orchestration scope into workspace file-management operations. That scope mismatch can lead an agent or caller to perform unintended file access or data-ingestion actions under the assumption they are part of a narrower orchestration-only capability, increasing the chance of unauthorized data handling or confused-deputy behavior.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The examples show executing third-party connector actions with real record fields like domains and company data, but provide no warning that this transmits user data to external services. In a CLI skill intended to orchestrate connectors, that omission can cause users to disclose sensitive or regulated data without realizing it leaves the platform boundary.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The webhook example instructs users to send batch completion data to an external URL without warning that results and metadata will be delivered off-platform, and it includes a hardcoded-looking shared secret example. This can normalize unsafe secret handling and lead users to expose batch outputs to untrusted endpoints or commit real secrets into shell history, docs, or source control.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example encourages use of actions that can enrich leads and modify external CRM state, and nearby examples also demonstrate uploading files, but it does not warn users that these operations may transmit data to third parties or create persistent changes in connected systems. In an agent skill focused on orchestration and external integrations, omission of side-effect warnings increases the chance of unintended disclosure or unauthorized data modification by users copying the example verbatim.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This combined example instructs the agent to research, enrich, and update a CRM using connected actions and resources, but it presents those steps as routine without highlighting that they can trigger real external writes and data sharing. In an orchestration skill, that context makes the issue more dangerous because the documented workflow is directly action-oriented and likely to be reused in production environments.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The knowledge file upload example normalizes uploading arbitrary documents to an agent without warning that files may contain sensitive internal, customer, or regulated data. While the snippet is only documentation, in this skill context it can lead users to expose confidential material to the platform or downstream model providers without appropriate review.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The examples include live-impacting operations such as draft-release deployment and cancellation of runs/batches without prominently warning that these actions modify production automations or interrupt active work. In a skill that directly drives an orchestration CLI, users may copy-paste commands into real environments, making accidental disruption of live workflows more likely.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The example instructs users to update and deploy a draft release but does not clearly warn that these commands persist workflow changes and can affect production behavior once deployed. In an orchestration skill, omission of that warning increases the risk of accidental configuration changes, unsafe template reuse, or unintended activation of modified node graphs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.