cartog-install
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs environment probing and software installation by executing shell commands such as
cartog --version,bash scripts/install.sh, andcartog self update. These commands are used to verify the current state and apply updates according to the pinned version. - [EXTERNAL_DOWNLOADS]: The skill references
https://www.cartog.dev/install.shas a resource for users to manually inspect or download the installer. This domain is the official site for the 'cartog' utility being managed by the skill. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon the output of external commands, specifically
cartog --versionandcartog self update --help. - Ingestion points: Output from command-line execution of the 'cartog' binary is read into the agent's context (SKILL.md).
- Boundary markers: None present; the agent parses the raw output to determine version numbers and feature support.
- Capability inventory: The skill possesses the ability to execute shell scripts and binary updates via
bashandcartog(SKILL.md). - Sanitization: No explicit sanitization or validation of the version string is performed beyond the agent's internal logic.
Audit Metadata