스킬 cargo-project

📦

cargo-project

Name: cargo-project
Author: getcargohq

v3.1.0 콘텐츠 리비전 r1 중간 위험 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수

Manage Cargo Workspaces as TypeScript Projects

Manual workspace changes are difficult to review and reproduce across environments. This skill guides TypeScript resource definitions, deployment previews, and state management with Cargo.

지원: Claude Codex Code(CC)

📊 72 적절함

Maintain this Skill? Claim it 📊 72 적절함

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "cargo-project" from https://skillstore.io/skills/getcargohq-cargo-project.md and its manifest at https://skillstore.io/api/skills/getcargohq-cargo-project/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/getcargohq-cargo-project.md 서명된 manifest GET /api/skills/getcargohq-cargo-project/manifest 서명된 lockfile GET /api/skills/getcargohq-cargo-project/lockfile

테스트해 보기

"cargo-project" 사용 중입니다. Add a HubSpot connector and contacts model, then show what would change.

예상 결과:

Proposed resources: a HubSpot connector and a contacts model linked through the connector handle.
Credential setup: provide HUBSPOT_API_KEY through the deployment environment, not source control.
Review checkpoint: create the connector before the model, inspect the plan, and wait for deployment approval.

"cargo-project" 사용 중입니다. Help me manage an existing agent without creating another copy.

예상 결과:

Adoption checklist: identify the live agent UUID and declare its connector, model, and tool dependencies.
State mapping: bind the declared agent identifier to the existing live resource.
Verification: the plan should show an update or no change, not a new agent.

"cargo-project" 사용 중입니다. Review my deployment approach for staging and production.

예상 결과:

Environment separation: use distinct workspace tokens and deploy-state pointers.
Preview boundary: run untrusted project imports only in isolated runners without secrets or write permissions.
Deployment gate: allow protected-branch changes after review, with explicit approval for deletions and recurring costs.

보안 감사

중간 위험

v1 • 2026. 10. 12. 버전별 보고서 열기

All 271 static alerts are false positives involving documentation formatting, fixed local imports, expected credential placeholders, and Cargo resource identifiers. One semantic risk remains: pull-request preview guidance treats imported TypeScript as safe without requiring isolation from credentials or privileged runners. No evidence found of prompt injection, credential exfiltration, or malicious payloads in the reviewed files.

스캔된 파일

1,971

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

중간

recipes/deploy-from-ci.md:45-46 SKILL.md:295-302 guides/authoring-resources.md:3-8

Pull-Request Previews Lack a Code-Execution Trust Boundary

The CI recipe says "Preview safely" on pull requests, while the loader imports project TypeScript and runs module side effects. Untrusted changes can execute before deployment approval and access runner credentials or files unless previews use isolated, unprivileged environments.

The documentation directly establishes import-time execution and recommends pull-request previews without isolation requirements. No exploit is shown; credential exposure depends on runner permissions.

위험 요인

⚡ 스크립트 포함 (3)

guides/authoring-resources.md:267 guides/authoring-resources.md:247 SKILL.md:53

⚙️ 외부 명령어 (50)

🌐 네트워크 접근 (9)

guides/authoring-resources.md:247 references/cookbooks.md:43 references/cookbooks.md:84 references/cookbooks.md:198 references/cookbooks.md:206 references/cookbooks.md:156 SKILL.md:6 SKILL.md:18 SKILL.md:166

📁 파일 시스템 접근 (39)

guides/authoring-resources.md:11 guides/authoring-resources.md:211 guides/authoring-resources.md:214 guides/authoring-resources.md:267 guides/deploy-and-state.md:8 guides/deploy-and-state.md:138 guides/deploy-and-state.md:161 guides/typed-config.md:66 guides/typed-config.md:50 recipes/add-connector-and-model.md:37 recipes/build-an-agent.md:48 recipes/build-an-agent.md:58 recipes/build-an-agent.md:59 recipes/build-an-agent.md:60 recipes/deploy-from-ci.md:10 recipes/migrate-existing-workspace.md:28 recipes/migrate-existing-workspace.md:29 recipes/migrate-existing-workspace.md:30 recipes/scaffold-a-project.md:19 recipes/scaffold-a-project.md:37 recipes/scaffold-a-project.md:82 recipes/scaffold-a-project.md:83 references/commands.md:23 references/resources.md:38 references/resources.md:89 references/resources.md:122 references/troubleshooting.md:15 references/troubleshooting.md:94 references/troubleshooting.md:100 references/troubleshooting.md:48 SKILL.md:55 SKILL.md:95 SKILL.md:119 SKILL.md:274 SKILL.md:314 SKILL.md:316 SKILL.md:324 SKILL.md:339 SKILL.md:355

🔑 환경 변수 (11)

guides/authoring-resources.md:64 guides/authoring-resources.md:83 recipes/add-connector-and-model.md:18 recipes/add-connector-and-model.md:60 recipes/deploy-from-ci.md:16 recipes/deploy-from-ci.md:60 recipes/scaffold-a-project.md:45 references/examples/full-workspace.md:54 references/examples/full-workspace.md:85 references/examples/full-workspace.md:101 references/troubleshooting.md:10

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/getcargohq-cargo-project/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/getcargohq-cargo-project/security.svg)](https://skillstore.io/skills/getcargohq-cargo-project?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/getcargohq-cargo-project?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/getcargohq-cargo-project/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/getcargohq-cargo-project.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

getcargohq. (2026). cargo-project security audit report (audit version 1) [Author version 3.1.0]. Skillstore. https://skillstore.io/skills/getcargohq-cargo-project/audits/1

BibTeX 인용

@techreport{getcargohq-getcargohq-cargo-project-2026,
  author = {getcargohq},
  title = {cargo-project security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/getcargohq-cargo-project/audits/1},
  note = {Author version 3.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cargo-project security audit report (audit version 1)"
version: "3.1.0"
type: report
authors:
  - name: "getcargohq"
date-released: "2026-10-12"
url: "https://skillstore.io/skills/getcargohq-cargo-project/audits/1"
identifiers:
  - type: other
    value: "skillstore:getcargohq-cargo-project:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

100

사양 준수

만들 수 있는 것

Version-Control a Revenue Workspace

Declare CRM connectors, data models, and automation together so workspace changes can receive code review before deployment.

Deploy Across Environments

Configure protected-branch deployments with workspace-scoped tokens and separate state pointers for staging and production.

Adopt Existing Cargo Resources

Bring live models and agents under project management without creating duplicate resources.

이 프롬프트를 사용해 보세요

Start a Cargo Project

Help me scaffold a Cargo project in an empty directory. Confirm the workspace, explain dependencies, and stop after showing the deployment plan.

Connect a CRM Data Model

Add a HubSpot connector and contacts model to my Cargo project. Use secret() for credentials, wire dependencies by handle, and request approval before deployment.

Adopt a Live Agent

Bring my existing Cargo agent under project management. Inspect its dependencies, bind its live UUID, and verify the plan avoids duplicate creation.

Design Protected CI Deployment

Design staging and production deployment jobs with separate states and scoped tokens. Isolate untrusted previews without secrets and require approval for pruning or paid schedules.

모범 사례

Review project code and deployment plans before approval; isolate untrusted previews from credentials and privileged runners.
Commit the deploy-state pointer, ignore generated working files, and maintain separate states for different environments.
Use secret() or workspaceEnv() for credentials, wire dependencies by handle, and approve recurring costs before enabling schedules.

피하기

Running unreviewed project TypeScript on an authenticated machine or privileged CI runner.
Using forced initialization in a nonempty project or deleting its deploy-state pointer to reset deployment.
Treating prune, destroy, DNS replacement, or paid schedules as routine changes without explicit review.

자주 묻는 질문

Does this skill manage Rust Cargo projects?

No. It manages Cargo platform workspaces through the cargo-ai CLI and TypeScript CDK.

Which AI tools can use this skill?

The skill declares support for Claude, Codex, and Claude Code. Command execution also requires the Cargo CLI and project dependencies.

Can I preview changes without deploying?

Yes. project plan previews resource changes, and project check validates definitions. Both load project code, so untrusted inputs require isolation.

Where should credentials be stored?

Use deployment environment secrets with secret(), or supported workspace catalog references with workspaceEnv(). Keep credential values out of source control.

What should I commit for deployment state?

Commit cargo.state.json, which points to workspace-held state in current projects. Ignore generated working files and coordinate migration from older inline state.

Does rollback undo changes in the live workspace?

No. Rollback restores the deployment-state snapshot. Correct the resource definitions and deploy again to address live changes.

개발자 세부 정보

작성자

getcargohq

라이선스

MIT

작성자 버전

v3.1.0

Skillstore 리비전

리포지토리

https://github.com/getcargohq/cargo-skills/tree/92c825ad4ba1bbbbeff96ae85e62187279f3854d/cargo-project

참조

dce5d81838e2be3f91f1efc08af35fe3256b6900

유지보수 최신성

2026. 10. 13.

사용량

0 다운로드 · 0 조회

파일 구조

📁 guides/

📄 authoring-resources.md

📄 deploy-and-state.md

📄 typed-config.md

📁 recipes/

📄 add-connector-and-model.md

📄 build-an-agent.md

📄 deploy-from-ci.md

📄 migrate-existing-workspace.md

📄 scaffold-a-project.md

📁 references/

📄 commands.md

📄 cookbooks.md

📁 examples/

📄 full-workspace.md

📄 resources.md

📄 troubleshooting.md

📄 skill-metadata.json

📄 SKILL.md

getcargohq의 다른 스킬

전체 보기

📦

cargo-cdk

Migrate cargo-cdk References to cargo-project

Existing cargo-cdk installations can retain an outdated skill name after a rename. This migration pointer identifies cargo-project as the replacement and documents the CLI naming change.

문서화 보기

📦

cargo-content

Manage Cargo Knowledge Files and Libraries

Scattered documents make workspace knowledge difficult to maintain. This skill guides Cargo CLI workflows to upload, organize, and manage knowledge files and connector-backed libraries.

생산성 보기

📦

cargo-ai

Build and Configure AI Agents in Cargo

Configuring agents requires coordinating prompts, models, knowledge, tools, and releases. This skill guides Cargo configuration through documented CLI workflows and examples.

생산성 보기

📦

cargo-mcp

Connect Cargo MCP and Run Workspace Actions

Using Cargo through an AI client requires correct authentication, workspace selection, and action inputs. This skill guides hosted MCP connections, cost inspection, batch execution, and result reporting.

생산성 보기

📦

cargo-context

Manage Your Cargo GTM Knowledge Base

Scattered buyer knowledge makes positioning and sales guidance difficult to maintain. This skill organizes Cargo workspace documents and connects personas, plays, objections, and evidence.

문서화 보기

전체 보기

📦

senior-devops

DevOps 파이프라인 및 배포 자동화

작성자 alirezarezvani

DevOps 작업에는 반복 가능한 파이프라인, 인프라, 배포 패턴이 필요한 경우가 많습니다. 이 스킬은 CI/CD, IaC, 배포, 운영 검토를 위한 스크립트와 참조 가이드를 제공합니다.

DevOps 및 인프라 보기

📦

cloud-devops

클라우드 DevOps 워크플로 조정

작성자 sickn33

클라우드 제공 작업은 여러 도구와 단계에 걸쳐 진행되는 경우가 많습니다. 이 스킬은 인프라, CI/CD, Kubernetes, 모니터링, 보안, 비용, 복구 작업을 명확한 프롬프트로 정리합니다.

DevOps 및 인프라 보기

📦

terraform-skill

더 나은 Terraform 모듈 구축

작성자 sickn33

Terraform 프로젝트는 종종 일관성 없는 모듈, 불명확한 테스트, 위험한 릴리스 워크플로로 커집니다. 이 스킬은 Claude, Codex, Claude Code에 더 안전한 인프라 제공을 위한 실용적인 Terraform 및 OpenTofu 패턴을 제공합니다.

DevOps 및 인프라 보기

📦

playwright-testing

Playwright 테스트 커버리지 개선

작성자 C0ntr0lledCha0s

구성, 로케이터, 픽스처가 일관되지 않으면 Playwright 스위트가 불안정해질 수 있습니다. 이 스킬은 신뢰할 수 있는 브라우저 테스트, 디버깅, 재사용 가능한 페이지 객체를 위한 실용적인 패턴을 제공합니다.

코딩 및 개발 보기

📦

testing

신뢰할 수 있는 테스트 자동화 구축

작성자 89jobrien

취약한 테스트는 릴리스를 늦추고 회귀를 숨깁니다. 이 스킬은 테스트 전략, TDD, 자동화, 커버리지 검토, Playwright 웹 검사를 안내합니다.

코딩 및 개발 보기

📦

nestjs-code-audit

Audit NestJS Code with Evidence-Backed Findings

작성자 amirtaherkhani

NestJS repositories can hide boundary flaws and runtime risks that lint results alone cannot reveal. This skill combines local evidence collection and semantic review into one prioritized report.

코딩 및 개발 보기

cargo-project

내 에이전트로 설치

에이전트가 읽기 쉬운 리소스

테스트해 보기

보안 감사

확인된 보안 우려 사항 (1)

위험 요인

보고서 링크 복사

Markdown 배지

HTML 배지

임베드 카드

APA 인용

BibTeX 인용

CITATION.cff

Skillstore 점수

만들 수 있는 것

Version-Control a Revenue Workspace

Deploy Across Environments

Adopt Existing Cargo Resources

이 프롬프트를 사용해 보세요

모범 사례

피하기

자주 묻는 질문

개발자 세부 정보

getcargohq의 다른 스킬

cargo-cdk

cargo-content

cargo-ai

cargo-mcp

cargo-context

관련 스킬

senior-devops

cloud-devops

terraform-skill

playwright-testing

testing

nestjs-code-audit