cargo-cdk

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The docs state that importing any .ts runs registration side-effects and explicitly recommend importing a generated .cargo-ai JS file while also describing CI deploys that use workspace tokens and env secrets — this combination permits arbitrary code execution at import time (RCE/backdoor) and potential exfiltration of secrets when runs happen in CI.