cargo-generate
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
cargo-generateto download git repositories from remote sources (e.g.,https://github.com/TheBevyFlock/bevy_new_2d) to use as project templates. - [REMOTE_CODE_EXECUTION]: The skill describes 'hooks' (init, pre, post) written in the Rhai scripting language that are embedded within templates. These scripts are executed during the generation process and have built-in capabilities for file system modification (
file::write,file::delete,file::rename). - [COMMAND_EXECUTION]: The documentation explicitly includes the
--allow-commandsflag, which enables thesystem::commandfunction in Rhai hooks. This allows a potentially malicious template to execute arbitrary shell commands on the local system. - [EXTERNAL_DOWNLOADS]: The installation instructions use
cargo install cargo-generate --locked, which downloads the tool's source code from a public registry for local compilation and installation.
Audit Metadata