Security audit
Security checks for vulnerabilities and agentic risk
The skill’s powerful workspace controls are clearly described, fit its purpose, and include meaningful review and approval steps.
Review the plan, schedules, costs, and pending executions before deployment. Connecting GitHub deploys immediately; use --no-auto-deploy to start with plans only. Pin package versions and review downloaded cookbooks. Confirm that contact data may be shared with enrichment providers and that uploaded files have suitable indexing and visibility settings. Limit service permissions and workspace secrets. Rollback restores deployment state, not completed external actions. This review covers the bundled instructions, not external package implementations.
The description declares workspace definition, planning, and deployment, but does not disclose a blanket destructive operation. The supplied scaffold recipe instead invokes destroy --all, a materially different and destructive action, not a supporting implementation detail of scaffolding.
Referenced artifact was not completely inspected
[`guides/authoring-resources.md`](guides/authoring-resources.md),
Referenced artifact was not completely inspected
, `defineWorkflow` bodies (tool/play logic) | [`guides/authoring-resources.md`](guides/authoring-resources.md) | The builder catalog, the handle/ref model, secr
Referenced artifact was not completely inspected
[`guides/authoring-resources.md`](guides/authoring-resources.md).
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
ayered on top. |
| `cargo-ai project add cookbook/<slug>` | Copy a worked example into this project — resources under `infra/<slug>/`, any helper scripts under `scripts/<slug>/`, and its procedure (`SKILL.md`, `references/`, `evals/`) under `.agents/skills/<slug>/`, with `.claude/skills/<slug>` symlinked to it (a copy where a link can't be made). Runs `check` afterwards so a duplicate slug surfaces immediately; never deploys, and never touches your `package.json`/`tsconfig.json`. `--overwrite` (replace existing files; default skips them), `--yes`. Omit the address to choose interactively. |
| `cargo-ai project add connector/<integration>` | Authorize a connector in the browser and write its `defineConnector`. `--connector-uuid <uuid>` adopts one already created there. |
| `cargo-ai project cookbook list\|search\|view` | Browse the cookbooks `add` installs — `view cookbook/<slug>` shows what one deploys, what it will ask you for, and its declared adaptations. |
| `cargo-ai project types
The suggested npx command can download and execute an unpinned CLI release, making behavior dependent on mutable registry contents. Although this is not an MCP server reference, a compromised release could execute with access to local source code and deployment credentials.
The unversioned npx skills invocation can execute a newly published package release with the agent's local permissions. Its installation role also introduces externally supplied agent instructions, increasing the consequences of a compromised dependency or upstream skill.
Using npx skills without a version can execute mutable registry code even when the stated operation only prints a skill. The read-only nature of the requested output does not constrain the downloaded executable's access to files or credentials.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **A connected GitHub repo deploys on merge — and on connect.** `cargo-ai project
state connect` plans every PR in a comment and runs `deploy --yes` on every push to
the production branch, starting with the branch head **the moment you connect**
(`--no-auto-deploy` to plan only). A merge whose plays and executions would exceed 100
emails, 100 LinkedIn actions, 100 chat messages, 5,000 audience adds or 2,500 credits —
or can't be counted — is held as **Action required** (`Needs approval: add the
cargo:approve-impact label`, not a failure) until someone labels the PR
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
cargo:approve-impact label`, not a failure) until someone labels the PR
`cargo:approve-impact`. That label is the user's cost approval: add it only on their
explicit yes. `secret()` does not resolve there (use `workspaceEnv()`), and while
auto-deploy is on every other deploy of the state is refused (409
`stateAutoDeployed`) — remove a GitHub Actions deploy rather than running both. See
[`recipes/deploy-from-ci.md`](recipes/deploy-from-ci.md).
- **A `definePlay`/`defineTool` graph with paid nodes gets a sample run before it
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
env var is inherited automatically.
- While Deploy on push is on, any other deploy of the state gets **409
`stateAutoDeployed`** ("… If this run is a GitHub Actions deploy, delete
.github/workflows/cargo-deploy.yml. To deploy by hand, turn auto-deploy off in
Settings > States."). Delete any Actions deploy workflow when you connect.
## B. Your own CI (fallback)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The state is connected to GitHub with Deploy on push on, so only Cargo's service user
may deploy it. A GitHub Actions deploy or a hand-run `deploy` is refused. Delete the
Actions deploy workflow, or turn auto-deploy off (**Settings → States**, or
`cargo-ai project state disconnect`) to deploy by hand.
## PR check: `Needs approval: add the cargo:approve-impact label`
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
`cargo:approve-impact`. That label is the user's cost approval: add it only on their
explicit yes. `secret()` does not resolve there (use `workspaceEnv()`), and while
auto-deploy is on every other deploy of the state is refused (409
`stateAutoDeployed`) — remove a GitHub Actions deploy rather than running both. See
[`recipes/deploy-from-ci.md`](recipes/deploy-from-ci.md).
- **A `definePlay`/`defineTool` graph with paid nodes gets a sample run before it
goes wide.** Deploying is not running, but the first thing that runs a deployed
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
positions; for a worker or app `env`, which rejects `workspaceEnv()`, the workspace
env var is inherited automatically.
- While Deploy on push is on, any other deploy of the state gets **409
`stateAutoDeployed`** ("… If this run is a GitHub Actions deploy, delete
.github/workflows/cargo-deploy.yml. To deploy by hand, turn auto-deploy off in
Settings > States."). Delete any Actions deploy workflow when you connect.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Two files declare the same id with different specs. Ids are the ledger key: rename the
newer one (a date prefix keeps the order readable).
## `409 stateAutoDeployed` — "Cargo deploys this state from <repo> when <branch> changes"
The state is connected to GitHub with Deploy on push on, so only Cargo's service user
may deploy it. A GitHub Actions deploy or a hand-run `deploy` is refused. Delete the
The recipe instructs the agent to create an enrichment workflow that passes input.email to the third-party Hunter service. This is an implemented workflow, not merely a tool listing, and the markdown does not warn that contact data will leave the user's environment when the tool runs.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
cargo-ai project state connect # from the project directory
cargo-ai project state disconnect # stop planning and deploying; state and resources stay
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
> the production branch head right away: `Connected this project to github.com/<repo> —
> pull requests get a plan, pushes to <branch> deploy. Deploying <branch> (<sha>) now.`
> Run `cargo-ai project plan` first and make sure what is on that branch is what you
> want live — including any pending executions. Pass `--no-auto-deploy` to start with
> plans only.
Cargo creates a service user named `GitHub <owner>/<repo>` holding the caller's
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
state from `cargo.state.json`. `project init` offers to
connect once the scaffold is pushed. The web-app equivalent is **Settings → States**.
> **Connecting deploys immediately.** With auto-deploy on (the default), connect deploys
> the production branch head right away: `Connected this project to github.com/<repo> —
> pull requests get a plan, pushes to <branch> deploy. Deploying <branch> (<sha>) now.`
> Run `cargo-ai project plan` first and make sure what is on that branch is what you
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
rt. |
| `cargo-ai project state list\|create\|bind\|remove` | Inspect, repoint and remove this project's deploy state — the workspace-held record of which live resource each declared one became. See [`../guides/deploy-and-state.md`](../guides/deploy-and-state.md). |
| `cargo-ai project state connect` | Connect this project's state to its GitHub repo: every PR gets a plan comment, pushes to the production branch deploy (as a service user). `--branch <name>` (default: origin's default branch), `--connector <uuid>` (GitHub connector whose account administers the repo), `--no-auto-deploy` (plan PRs only), `--json`. **Deploys the production branch immediately** unless `--no-auto-deploy`. See [`../recipes/deploy-from-ci.md`](../recipes/deploy-from-ci.md). |
| `cargo-ai project state disconnect` | Stop planning and deploying from GitHub. The state and its resources stay. |
| `cargo-ai project destroy` | Tear down resources recorded in state. `--target <id>` for one, `--all` for everything. |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
rt. |
| `cargo-ai project state list\|create\|bind\|remove` | Inspect, repoint and remove this project's deploy state — the workspace-held record of which live resource each declared one became. See [`../guides/deploy-and-state.md`](../guides/deploy-and-state.md). |
| `cargo-ai project state connect` | Connect this project's state to its GitHub repo: every PR gets a plan comment, pushes to the production branch deploy (as a service user). `--branch <name>` (default: origin's default branch), `--connector <uuid>` (GitHub connector whose account administers the repo), `--no-auto-deploy` (plan PRs only), `--json`. **Deploys the production branch immediately** unless `--no-auto-deploy`. See [`../recipes/deploy-from-ci.md`](../recipes/deploy-from-ci.md). |
| `cargo-ai project state disconnect` | Stop planning and deploying from GitHub. The state and its resources stay. |
| `cargo-ai project destroy` | Tear down resources recorded in state. `--target <id>` for one, `--all` for everything. |
The command invokes an unpinned npm executable through npx, potentially downloading and executing a release that has not been reviewed. Although this is a skill installer rather than an MCP server, a compromised package release could execute with the invoking user's permissions, exposing repository contents or available workspace credentials.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
them to OpenAI — agents can read the file but not search or analyze it; use it for
files a worker or play serves rather than an agent retrieves. `visibility: "public"`
gives the file a stable **unauthenticated** link
(`https://api.getcargo.io/files/public/<uuid>/<name>`). `mirrorToContext: false`
keeps it out of the context repo (the default commits it under `.files/`). Changing
`index` or `mirrorToContext` re-uploads the bytes in place, keeping the uuid;
changing `visibility` is an in-place update. Each is sent only when declared, so a