cargo-diagnostics
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages the installation of
@cargo-ai/cli@latestvia npm. This is a vendor-owned package from the official registry and is used for the skill's primary diagnostic functions.- [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands using thecargo-aiCLI (e.g.,cargo-ai orchestration run get,cargo-ai orchestration query execute). These commands are standard operations for querying diagnostic data, logs, and billing metrics within the vendor's platform. All commands are executed in the context of user-initiated diagnostic workflows.- [DATA_EXPOSURE]: The skill instructions involve reading run contexts and billing metrics. While these can contain business-sensitive data, the skill includes explicit guidelines for 'Presenting findings' which advise against dumping raw JSON and prioritize user privacy and compact summaries. Findings are accessed through the user's own authenticated CLI session.- [CREDENTIALS_SAFE]: Instructions for signing in (cargo-ai login) use standard methods like email codes, OAuth, or pre-existing API tokens. It correctly advises users to use environmental variables or specific flags for tokens in CI environments and does not include any hardcoded secrets.
Audit Metadata