deploy-cookbook
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands to manage the deployment lifecycle. This includes package installation (
npm install), authentication (cargo-ai login), project initialization (cargo-ai cdk init), and deployment (cargo-ai cdk deploy). - [EXTERNAL_DOWNLOADS]: The skill fetches external resources, including the
@cargo-ai/cliNode.js package and cookbook templates from thegetcargohq/cargo-cookbooksGitHub repository. These resources are managed by the skill's author. - [CREDENTIALS_UNSAFE]: The instructions detail the process for authenticating with the Cargo AI service using email-based codes. Importantly, the skill includes a safety directive to manage secrets via
.envfiles and explicitly forbids the agent from reading, printing, or echoing these sensitive values. - [DATA_EXPOSURE]: The skill performs a check on the local filesystem at
~/.claude/plugins/installed_plugins.jsonto determine if installation tracking should be skipped. It also records installation metadata (slug and session ID) via an API call to the vendor's workspace management service.
Audit Metadata