skills/jrollin/cartog/cartog-install/Gen Agent Trust Hub

cartog-install

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands to check the version of the 'cartog' binary and run its built-in update mechanism. These operations are restricted to the tool's own lifecycle management.
  • [EXTERNAL_DOWNLOADS]: The skill references the official vendor website (cartog.dev) for manual installation instructions. This is a legitimate vendor resource and is presented as an alternative for user inspection.
  • [SAFE]: The installation process uses a local script bundled within the skill's directory structure (${CLAUDE_PLUGIN_ROOT}), avoiding arbitrary remote code execution during the automated path.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 09:32 AM
Security Audit — agent-trust-hub — cartog-install