Security audit

cargo-workspace-management

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches its Cargo workspace-admin purpose, but it includes high-impact admin actions plus optional Claude session hooks that persist locally and summarize session transcripts without enough privacy scoping.

Install only if you are comfortable giving the Cargo CLI workspace-management authority. Confirm the active workspace before user, role, token, folder, file, report, or session writes; do not upload sensitive files unless they are intended for Cargo storage; and avoid enabling the Claude session hooks unless your organization is comfortable with local hook persistence and transcript-derived session summaries being recorded.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documentation promotes logging every Claude Code session and generating summaries of session activity, which can capture sensitive prompts, code context, secrets, or internal operational details. That data collection is broader than the skill’s stated workspace-management purpose, so users may enable surveillance-like behavior without clear necessity, minimization, or consent boundaries.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The SessionEnd hook reads the transcript and invokes an LLM to summarize it, introducing automated inspection of potentially sensitive session content without a strong connection to the declared admin/feedback function of the skill. This expands exposure of user data to additional tooling and storage paths, increasing privacy and data-handling risk if the transcript contains credentials, proprietary code, or personal information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to upsert Claude Code session records, including titles and summaries, and notes that installer hooks can automate SessionStart/Stop/SessionEnd reporting. Because it lacks a clear warning, consent requirement, or guidance to avoid sensitive content, users may unknowingly transmit session metadata and potentially transcript-derived summaries to a remote workspace service, creating privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill provides a `file upload` command and states that uploaded files become workspace files for batch runs, returning an `s3Filename`, but it does not warn that local data is being transmitted to remote storage. This can lead an agent or user to upload sensitive CSVs or other files without understanding the disclosure, retention, or access implications.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example recommends `curl ... | sh`, which executes network-delivered code immediately in the user’s shell with no review, pinning, or integrity verification. If the remote endpoint, transport, or publishing pipeline is compromised, users could run arbitrary attacker-controlled code on their machine.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.