cargo-cdk

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill wraps the cargo-ai CLI tool to perform infrastructure orchestration. It executes subcommands such as cdk plan, cdk deploy, and cdk destroy to reconcile local TypeScript definitions with the Cargo platform's live resources.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the @cargo-ai/cli and @cargo-ai/cdk packages from the official npm registry. It also references external worked examples (cookbooks) from the vendor's public GitHub repository (getcargohq/gtm-skills). These resources are provided by the author and are considered part of the tool's intended functionality.
  • [CREDENTIALS_SAFE]: The skill implements a secure credential handling pattern using the secret() and env() functions. This approach ensures that sensitive data, such as API keys, is resolved from the execution environment at deploy time and is explicitly excluded from content hashes and the committed cargo.state.json file.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 07:39 AM
Security Audit — agent-trust-hub — cargo-cdk