cartog-install
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands to check the version of the 'cartog' binary and run its built-in update mechanism. These operations are restricted to the tool's own lifecycle management.
- [EXTERNAL_DOWNLOADS]: The skill references the official vendor website (cartog.dev) for manual installation instructions. This is a legitimate vendor resource and is presented as an alternative for user inspection.
- [SAFE]: The installation process uses a local script bundled within the skill's directory structure (${CLAUDE_PLUGIN_ROOT}), avoiding arbitrary remote code execution during the automated path.
Audit Metadata