cargo-cdk
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill wraps the
cargo-aiCLI tool to perform infrastructure orchestration. It executes subcommands such ascdk plan,cdk deploy, andcdk destroyto reconcile local TypeScript definitions with the Cargo platform's live resources. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the
@cargo-ai/cliand@cargo-ai/cdkpackages from the official npm registry. It also references external worked examples (cookbooks) from the vendor's public GitHub repository (getcargohq/gtm-skills). These resources are provided by the author and are considered part of the tool's intended functionality. - [CREDENTIALS_SAFE]: The skill implements a secure credential handling pattern using the
secret()andenv()functions. This approach ensures that sensitive data, such as API keys, is resolved from the execution environment at deploy time and is explicitly excluded from content hashes and the committedcargo.state.jsonfile.
Audit Metadata