Skills cargo-project

📦

cargo-project

Name: cargo-project
Author: getcargohq

v3.1.0 Content revision r1 Medium Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Manage Cargo Workspaces as TypeScript Projects

Manual workspace changes are difficult to review and reproduce across environments. This skill guides TypeScript resource definitions, deployment previews, and state management with Cargo.

Supports: Claude Codex Code(CC)

📊 72 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "cargo-project" from https://skillstore.io/skills/getcargohq-cargo-project.md and its manifest at https://skillstore.io/api/skills/getcargohq-cargo-project/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/getcargohq-cargo-project.md Signed manifest GET /api/skills/getcargohq-cargo-project/manifest Signed lockfile GET /api/skills/getcargohq-cargo-project/lockfile

Test it

Using "cargo-project". Add a HubSpot connector and contacts model, then show what would change.

Expected outcome:

Proposed resources: a HubSpot connector and a contacts model linked through the connector handle.
Credential setup: provide HUBSPOT_API_KEY through the deployment environment, not source control.
Review checkpoint: create the connector before the model, inspect the plan, and wait for deployment approval.

Using "cargo-project". Help me manage an existing agent without creating another copy.

Expected outcome:

Adoption checklist: identify the live agent UUID and declare its connector, model, and tool dependencies.
State mapping: bind the declared agent identifier to the existing live resource.
Verification: the plan should show an update or no change, not a new agent.

Using "cargo-project". Review my deployment approach for staging and production.

Expected outcome:

Environment separation: use distinct workspace tokens and deploy-state pointers.
Preview boundary: run untrusted project imports only in isolated runners without secrets or write permissions.
Deployment gate: allow protected-branch changes after review, with explicit approval for deletions and recurring costs.

Security Audit

Medium Risk

v1 • 10/12/2026 Open versioned report

All 271 static alerts are false positives involving documentation formatting, fixed local imports, expected credential placeholders, and Cargo resource identifiers. One semantic risk remains: pull-request preview guidance treats imported TypeScript as safe without requiring isolation from credentials or privileged runners. No evidence found of prompt injection, credential exfiltration, or malicious payloads in the reviewed files.

Files scanned

1,971

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

recipes/deploy-from-ci.md:45-46 SKILL.md:295-302 guides/authoring-resources.md:3-8

Pull-Request Previews Lack a Code-Execution Trust Boundary

The CI recipe says "Preview safely" on pull requests, while the loader imports project TypeScript and runs module side effects. Untrusted changes can execute before deployment approval and access runner credentials or files unless previews use isolated, unprivileged environments.

The documentation directly establishes import-time execution and recommends pull-request previews without isolation requirements. No exploit is shown; credential exposure depends on runner permissions.

Risk Factors

⚡ Contains scripts (3)

guides/authoring-resources.md:267 guides/authoring-resources.md:247 SKILL.md:53

⚙️ External commands (50)

🌐 Network access (9)

guides/authoring-resources.md:247 references/cookbooks.md:43 references/cookbooks.md:84 references/cookbooks.md:198 references/cookbooks.md:206 references/cookbooks.md:156 SKILL.md:6 SKILL.md:18 SKILL.md:166

📁 Filesystem access (39)

guides/authoring-resources.md:11 guides/authoring-resources.md:211 guides/authoring-resources.md:214 guides/authoring-resources.md:267 guides/deploy-and-state.md:8 guides/deploy-and-state.md:138 guides/deploy-and-state.md:161 guides/typed-config.md:66 guides/typed-config.md:50 recipes/add-connector-and-model.md:37 recipes/build-an-agent.md:48 recipes/build-an-agent.md:58 recipes/build-an-agent.md:59 recipes/build-an-agent.md:60 recipes/deploy-from-ci.md:10 recipes/migrate-existing-workspace.md:28 recipes/migrate-existing-workspace.md:29 recipes/migrate-existing-workspace.md:30 recipes/scaffold-a-project.md:19 recipes/scaffold-a-project.md:37 recipes/scaffold-a-project.md:82 recipes/scaffold-a-project.md:83 references/commands.md:23 references/resources.md:38 references/resources.md:89 references/resources.md:122 references/troubleshooting.md:15 references/troubleshooting.md:94 references/troubleshooting.md:100 references/troubleshooting.md:48 SKILL.md:55 SKILL.md:95 SKILL.md:119 SKILL.md:274 SKILL.md:314 SKILL.md:316 SKILL.md:324 SKILL.md:339 SKILL.md:355

🔑 Env variables (11)

guides/authoring-resources.md:64 guides/authoring-resources.md:83 recipes/add-connector-and-model.md:18 recipes/add-connector-and-model.md:60 recipes/deploy-from-ci.md:16 recipes/deploy-from-ci.md:60 recipes/scaffold-a-project.md:45 references/examples/full-workspace.md:54 references/examples/full-workspace.md:85 references/examples/full-workspace.md:101 references/troubleshooting.md:10

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/getcargohq-cargo-project/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/getcargohq-cargo-project/security.svg)](https://skillstore.io/skills/getcargohq-cargo-project?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/getcargohq-cargo-project?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/getcargohq-cargo-project/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/getcargohq-cargo-project.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

getcargohq. (2026). cargo-project security audit report (audit version 1) [Author version 3.1.0]. Skillstore. https://skillstore.io/skills/getcargohq-cargo-project/audits/1

BibTeX citation

@techreport{getcargohq-getcargohq-cargo-project-2026,
  author = {getcargohq},
  title = {cargo-project security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/getcargohq-cargo-project/audits/1},
  note = {Author version 3.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cargo-project security audit report (audit version 1)"
version: "3.1.0"
type: report
authors:
  - name: "getcargohq"
date-released: "2026-10-12"
url: "https://skillstore.io/skills/getcargohq-cargo-project/audits/1"
identifiers:
  - type: other
    value: "skillstore:getcargohq-cargo-project:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Version-Control a Revenue Workspace

Declare CRM connectors, data models, and automation together so workspace changes can receive code review before deployment.

Deploy Across Environments

Configure protected-branch deployments with workspace-scoped tokens and separate state pointers for staging and production.

Adopt Existing Cargo Resources

Bring live models and agents under project management without creating duplicate resources.

Try These Prompts

Start a Cargo Project

Help me scaffold a Cargo project in an empty directory. Confirm the workspace, explain dependencies, and stop after showing the deployment plan.

Connect a CRM Data Model

Add a HubSpot connector and contacts model to my Cargo project. Use secret() for credentials, wire dependencies by handle, and request approval before deployment.

Adopt a Live Agent

Bring my existing Cargo agent under project management. Inspect its dependencies, bind its live UUID, and verify the plan avoids duplicate creation.

Design Protected CI Deployment

Design staging and production deployment jobs with separate states and scoped tokens. Isolate untrusted previews without secrets and require approval for pruning or paid schedules.

Best Practices

Review project code and deployment plans before approval; isolate untrusted previews from credentials and privileged runners.
Commit the deploy-state pointer, ignore generated working files, and maintain separate states for different environments.
Use secret() or workspaceEnv() for credentials, wire dependencies by handle, and approve recurring costs before enabling schedules.

Avoid

Running unreviewed project TypeScript on an authenticated machine or privileged CI runner.
Using forced initialization in a nonempty project or deleting its deploy-state pointer to reset deployment.
Treating prune, destroy, DNS replacement, or paid schedules as routine changes without explicit review.

Frequently Asked Questions

Does this skill manage Rust Cargo projects?

No. It manages Cargo platform workspaces through the cargo-ai CLI and TypeScript CDK.

Which AI tools can use this skill?

The skill declares support for Claude, Codex, and Claude Code. Command execution also requires the Cargo CLI and project dependencies.

Can I preview changes without deploying?

Yes. project plan previews resource changes, and project check validates definitions. Both load project code, so untrusted inputs require isolation.

Where should credentials be stored?

Use deployment environment secrets with secret(), or supported workspace catalog references with workspaceEnv(). Keep credential values out of source control.

What should I commit for deployment state?

Commit cargo.state.json, which points to workspace-held state in current projects. Ignore generated working files and coordinate migration from older inline state.

Does rollback undo changes in the live workspace?

No. Rollback restores the deployment-state snapshot. Correct the resource definitions and deploy again to address live changes.