cargo

SUSPICIOUS. The skill is mostly coherent with its purpose as a Cargo CLI router, and its credential use/data flows appear directed to the Cargo ecosystem rather than an unrelated interceptor. However, it carries medium risk because it instructs transitive skill installation and a `curl | sh` hook installer, and it automates/session-writes user activity metadata through the CLI.