cargo

SUSPICIOUS. The skill is largely coherent with its stated purpose as a Cargo CLI router and setup guide, and its primary installs appear same-org and registry-backed. However, it expands trust by refreshing/installing software mid-session, uses transitive skill installation, references an unverified hosted INSTALL.md, and includes optional external actions (reports, GitHub starring). These are proportionate enough to avoid a malicious classification, but the install/update footprint is broader than a pure documentation router.