cargo-hosting
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
cargo-aiCLI to perform lifecycle operations for hosted resources, including creating resource slots, initializing local scaffolds from templates, and managing deployments. These operations are standard for the platform's intended use. - [EXTERNAL_DOWNLOADS]: The skill identifies the
@cargo-ai/cliNode.js package as a prerequisite. This package is the official command-line tool provided by the vendor (getcargohq) and is necessary for executing the hosting commands described in the skill. - [DATA_EXPOSURE]: The skill includes a command,
hosting app env, which retrieves configuration details for local development. The instructions correctly guide the user to redirect this output into a local.env.localfile, adhering to secure credential management practices by avoiding plain-text exposure in logs or prompts.
Audit Metadata