cargo-workspace-management

• Outcome: Review
• Latest audit: Sep 21, 2026 · 10:30 PM UTC
• Version: 1.3.1

Overview

This appears to be a legitimate Cargo workspace administration skill, but it gives agents broad admin power and documents automatic session-summary persistence that users should review before installing.

Install only if you trust Cargo and want an agent to administer the workspace. Use a least-privilege account or token, confirm targets before user/token/env-var changes, avoid unpinned latest CLI execution where possible, and enable session hooks only after confirming what transcript-derived data is stored, who can see it, and how it can be disabled or deleted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/examples/sessions.md (reported line 71)May include surrounding context.

md

The hooks are thin wrappers around the `session upsert` command documented above; the scripts live in [`hooks/`](../../../hooks/) in this repo if you want to read or customize them.

> **The `curl … install.sh | sh` installer that used to scaffold these is retired.** It installs nothing now — it prints a notice and exits non-zero. Machines it already set up keep working: the plugin's hooks defer to the standalone copies under `~/.claude/hooks/` when those exist, so a session is never logged twice. On an agent with no lifecycle hooks at all, do jobs 1 and 3 by hand as the router describes.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/examples/sessions.md (reported line 71)May include surrounding context.

md

The hooks are thin wrappers around the `session upsert` command documented above; the scripts live in [`hooks/`](../../../hooks/) in this repo if you want to read or customize them.

> **The `curl ... install.sh | sh` installer that used to scaffold these is retired.** It installs nothing now — it prints a notice and exits non-zero. Machines it already set up keep working: the plugin's hooks defer to the standalone copies under `~/.claude/hooks/` when those exist, so a session is never logged twice. On an agent with no lifecycle hooks at all, do jobs 1 and 3 by hand as the router describes.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases for submitting feedback are broad phrases like 'this CLI command is broken' or 'share this session with Cargo', which overlap with normal conversation and troubleshooting. In an agentic environment, that raises the risk of accidental invocation of external reporting or data-sharing actions without clear user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The skill recommends running the CLI via npx @cargo-ai/cli without a pinned version, which allows the latest published package to be fetched at execution time. That creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be executed in a privileged workspace-administration context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented session recording behavior stores session identifiers, titles, summaries, and potentially transcript-derived summaries, but the skill description lacks an explicit privacy warning. Because the skill also references automatic SessionStart/Stop/SessionEnd hooks, users may have their session metadata persisted without understanding that this occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level skill description omits that the skill can create, update, and delete workspace environment variables that are injected into every worker, app, and agent. This hides a highly sensitive capability from users and routing systems, increasing the chance of unintended secret modification, broad configuration changes, or abuse of a privileged token.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document introduces session tracking and persistent storage of Claude Code session metadata for a workspace-management skill whose declared purpose is workspace administration, not telemetry or conversation logging. This expands the skill's effective data-handling scope beyond user expectations and increases the chance that sensitive operational context is collected without explicit consent or policy review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The example explicitly recommends recording and later overwriting session rows with real titles and summaries, normalizing persistent storage of AI-generated session content. While not exploit code, it encourages retention of potentially sensitive work descriptions in a workspace-management datastore, which can become a privacy and disclosure issue if access controls or retention practices are weak.

Content

Scanner excerpt · references/examples/sessions.md (reported line 44)May include surrounding context.

md

--title "Claude Code session abc-123" \
  --summary "Session in progress."

# Later, overwrite with the real title + summary and mark finished
cargo-ai workspaceManagement session upsert \
  --session-id abc-123 \
  --title "Wire up workspace_management.sessions" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented hooks read transcripts and derive summaries from them, which materially exceeds ordinary workspace-management actions like member or token administration. Because transcript processing can expose secrets, internal prompts, and user requests, this undocumented behavioral expansion creates a privacy and data-boundary risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The hooks persist transcript-derived titles and summaries into session records and log diagnostic details to a file, creating a natural path for sensitive prompts, secrets, customer data, or internal system details to be copied into durable storage. Even lightweight summarization can leak confidential content because summaries often preserve the most salient sensitive facts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The SessionEnd hook states that it reads the transcript and sends it to claude -p for summarization, but the documentation does not provide a prominent warning or consent flow that user content is being forwarded for model processing. Users may reasonably assume session metadata is local bookkeeping, not transcript submission for secondary analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples show how to invite users, change roles, and remove members in an admin-focused workspace management skill without any caution about authorization, role sensitivity, or the operational impact of these actions. In this context, omission of warnings can normalize high-impact commands and increase the chance of accidental privilege changes or disruptive removals by operators using copied examples.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The troubleshooting guidance instructs users to run npx @cargo-ai/cli without pinning a specific package version. This can cause execution of whatever version is currently published at invocation time, which creates a supply-chain risk if a malicious or compromised release is published, especially because this skill manages admin workspace actions and tokens.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description does not mention that it can persist Claude Code session metadata into workspace management. Undisclosed session logging/sharing capabilities can surprise users and may result in metadata being stored or shared without informed consent, especially in administrative workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file includes a command to remove a folder, which is a destructive operation affecting workspace organization. Although it notes that resources must be removed first, it does not explicitly warn the user that the command deletes the folder or advise caution before running it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.