skills/jrollin/cartog/cartog-install/Gen Agent Trust Hub

cartog-install

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs environment probing and software installation by executing shell commands such as cartog --version, bash scripts/install.sh, and cartog self update. These commands are used to verify the current state and apply updates according to the pinned version.
  • [EXTERNAL_DOWNLOADS]: The skill references https://www.cartog.dev/install.sh as a resource for users to manually inspect or download the installer. This domain is the official site for the 'cartog' utility being managed by the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon the output of external commands, specifically cartog --version and cartog self update --help.
  • Ingestion points: Output from command-line execution of the 'cartog' binary is read into the agent's context (SKILL.md).
  • Boundary markers: None present; the agent parses the raw output to determine version numbers and feature support.
  • Capability inventory: The skill possesses the ability to execute shell scripts and binary updates via bash and cartog (SKILL.md).
  • Sanitization: No explicit sanitization or validation of the version string is performed beyond the agent's internal logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:32 AM