Security audit
Security checks for vulnerabilities and agentic risk
This Cargo storage skill matches its purpose, but it needs review because it exposes token-bearing webhook URLs and can alter or delete workspace data.
Install only if you want an agent to administer Cargo workspace storage. Require confirmation before deletes, relationship replacements, exports, token creation, or webhook setup. Treat webhook URLs containing tokens as secrets, avoid placing them in chat, logs, files, or shell history, prefer header-based or secret-manager delivery, and rotate any token that may have been exposed.
The skill provides exact steps to derive and output a functioning webhook URL with embedded credentials from workspace token data. In an agent setting, this is especially dangerous because the agent may obediently reveal the URL back to the user or store it in tool logs, turning a documentation example into a credential disclosure vector.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
This section expands from ordinary storage management into instructions for deriving a live ingest endpoint and obtaining an API token, which materially broadens the skill from schema/query operations into secret-handling and external write access. That increases the chance an agent will surface or operationalize sensitive connection details in contexts where the user only asked about storage structure or records.
The text directs the agent to hand out or derive webhook connection details for ingest models except in a narrow auto-ingest case. Even before the explicit token-printing example, this normalizes disclosure of sensitive integration endpoints and increases the likelihood of exposing connection material beyond least-privilege expectations.
The example explicitly retrieves a raw API token and prints a full ingest URL containing that token to stdout. Tokens embedded in command output, terminal history, logs, screenshots, shell tracing, or agent transcripts are easily leaked and can grant direct write access to the model ingest endpoint.
The example shows a destructive column remove command without any warning about permanent data loss, downstream schema breakage, or the need to verify dependencies first. In a storage-management skill, users may copy commands directly, so omission of safety guidance materially increases the chance of accidental destructive changes.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## Column kinds reference
| Kind | Use for | Required extra fields |
| ---------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `custom` | User-defined fields | — |
| `computed` | Values derived from an expression over other columns | `expression`; optionally `columnsUsed` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Kind | Use for | Required extra fields |
| ---------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `custom` | User-defined fields | — |
| `computed` | Values derived from an expression over other columns | `expression`; optionally `columnsUsed` |
| `metric` | Aggregated values from a related model | `relationshipUuid`, `aggregation.function`, `aggregation.columnSlug`; optionally `filter` |
| `lookup` | A single field value pulled from a related model via a join | `join.toModelUuid`, `join.fromColumnSlug`, `join.toColumnSlug`, `extractColumnSlug`; optionally `filter` |
The example explicitly constructs a webhook URL containing a live API token in a shell command and echoes the full URL, but only warns not to write it to files or reports. It does not warn that embedding secrets in command lines can leak them through shell history, terminal scrollback, process listings, CI logs, or copied commands, which is a real secret-handling weakness in operational guidance.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# one record
curl -X POST "$BASE/v1/models/$MODEL_UUID/records/ingest?token=$TOKEN" \
-H "Content-Type: application/json" \
-d '{"email":"ada@example.com","company":"example.com"}'
The example documents a destructive model remove command with only a dependency-failure note, but it does not clearly warn that the operation deletes a model and may cause irreversible data loss or workflow breakage if used incorrectly. In a storage-management skill that directly manipulates business data models, omission of a prominent deletion warning increases the risk of accidental destructive actions by users or downstream agents.
This is a markdown file, so SQP-2 applies. The section explains how to download full result sets and notes that the response is a signed URL, but it provides no warning that exports may contain sensitive data or that signed URLs should be handled carefully because they grant access to the exported results.
The troubleshooting guide recommends running npx @cargo-ai/cli without pinning a specific version. That allows execution of whatever package version is current at install time, which can introduce supply-chain risk if a malicious or compromised release is published. In a skill that directly manages workspace models and executes storage queries, CLI compromise could expose or alter business data.
The document explains that relationship set replaces the entire dataset relationship set and deletes any omitted entries, but it does so as routine troubleshooting guidance without an explicit warning or confirmation step. In this storage-management context, users may follow the advice and unintentionally delete relationship definitions, causing integrity loss or breaking dependent workflows.
No suspicious patterns detected.