Security audit
Security checks across malware telemetry and agentic risk
This skill is mainly for Cargo workspace administration, but it also recommends persistent Claude session hooks that read transcripts and log summaries, plus an unverified pipe-to-shell installer.
Review this carefully before installing. Use it only with a Cargo workspace/account where you are comfortable granting administrative CLI authority, avoid uploading sensitive files unless necessary, do not create broad tokens casually, and decline or disable the Claude session hooks unless you explicitly want session titles, summaries, and transcript-derived activity to be recorded. Prefer a reviewed, pinned, or package-managed installer path instead of piping a remote script directly into a shell.
- `--finished` stamps `finished_at = now`. Use `--finished-at <iso>` for an explicit timestamp instead. - Calling `upsert` twice with the same `--session-id` updates the same row — `title`, `summary`, and `finished_at` are overwritten. Returns the upserted session as JSON. The Cargo installer (`curl -fsSL https://api.getcargo.io/install.sh | sh`) wires SessionStart + Stop + SessionEnd hooks that call this command automatically: SessionStart writes a placeholder, the per-turn Stop hook checkpoints the row (no `--finished`), and SessionEnd writes the transcript-driven AI summary with `--finished` — see [`references/examples/sessions.md`](references/examples/sessions.md). ## Workspace files
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
