mirror of https://github.com/getcargohq/cargo-skills.git synced 2026-09-14 19:17:15 +08:00

Files

T

Auree Aubert 6683645b00 CI: run the HOL AI plugin scanner (#102 )

* CI: run the HOL AI plugin scanner

hashgraph-online/awesome-ai-plugins requires every listed plugin's source
repo to invoke `ai-plugin-scanner-action` on push/pull_request before the
listing PR can merge (getcargohq/cargo-skills#83 → their PR #72).

Pinned to a full commit SHA instead of the floating `v1` tag, with a
read-only token and no secrets in scope, so a third-party action in our
workflow surface can't reach anything it shouldn't.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* CI: publish the scanner report when the scan fails

The action's built-in summary step is `if: success()`, so a failing scan
prints counts and no findings. Render markdown to a file and cat it into
the step summary unconditionally.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* CI: tee the scanner report to the job log as well

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* CI: clear the plugin scanner's 80-point / no-high gate

The scanner job this PR added failed on its first run: 71/100 against a
`min_score` of 80, one critical finding and one high. The awesome-ai-plugins
contribution gate re-scans this repo with the same two thresholds, so the
findings had to be fixed rather than configured around. Now 92/100 (A), zero
critical, zero high.

- Pin every `uses:` in .github/workflows/ to a full commit SHA, and add
  .github/dependabot.yml so the pins move weekly instead of never.
- Add SECURITY.md: private reporting via the Security tab, and an explicit
  boundary between this bundle and the cargo-ai CLI / Cargo platform.
- Stop inlining `curl … install.sh` in cargo/SKILL.md. The command now lives
  only in README.md, where a human runs it; the router keeps the guidance
  (never run it on the user's behalf) and points there.
- Use execFileSync, not execSync, for `npm root -g` in the QA script library —
  no shell to interpret a command string. Windows gets the npm.cmd shim.
- Fill in repository/license/keywords in .codex-plugin/plugin.json, a category
  on the .agents marketplace entry, and add .codexignore.
- Set write_step_summary: false on the scanner action and publish the report
  ourselves, so it lands once whether the gate passes or fails.

Two medium findings are left standing and documented in CHANGELOG.md: the
`anthropic` provider slug in cargo-gtm's description (correct, and CI-synced
with the CLI) and `fetch(` in the run-output downloader (the point of the
function). Neither is a gate failure.

Co-Authored-By: Auree Aubert <16732193+aureeaubert@users.noreply.github.com>
Co-Authored-By: replicas-connector[bot] <replicas-connector[bot]@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: replicas-connector[bot] <replicas-connector[bot]@users.noreply.github.com>
Co-authored-by: Auree Aubert <16732193+aureeaubert@users.noreply.github.com>

2026-08-14 19:00:18 -07:00

3.0 KiB

Raw Permalink Blame History

Security policy

What this repository ships

cargo-skills is a bundle of agent skills: markdown instructions, plus a small number of runnable files — the approval and session hooks under hooks/, the QA helper scripts under cargo-gtm/scripts/, and the CI scripts under .github/scripts/. It contains no server, no service, and no credentials. It talks to Cargo only by telling an agent to invoke the separately-installed @cargo-ai/cli.

That shape sets the boundary for what belongs here:

In scope — anything in this repository that could make an agent take an action its user did not authorize: an approval-hook bypass in hooks/, a command-injection or path-traversal bug in a runnable script, a skill instruction that leaks credentials or workspace data, a supply-chain weakness in the CI workflows, or a tampered/typosquatted release of this bundle.
Out of scope — vulnerabilities in the cargo-ai CLI itself, in the Cargo platform or its API, or in the third-party data providers the skills call. Report those to Cargo directly rather than here; a report filed here about the platform will be forwarded, which only slows it down.

Reporting a vulnerability

Use GitHub's private vulnerability reporting: open the Security tab of this repository and file a draft advisory. That channel is private to the maintainers until an advisory is published.

Please do not open a public issue or pull request for a security report — this repository is installed directly by agents, so a public report is a disclosed exploit for every install at once.

A useful report includes the affected file and version (see CHANGELOG.md and the version field in cargo/SKILL.md), what an attacker can cause an agent to do, and the smallest reproduction you have.

You can expect an acknowledgement within three business days and an assessment with a fix or mitigation plan within ten.

Supported versions

Only the latest published version of the bundle is supported. Fixes ship as a new version rather than as patches to older ones — agents install from the default branch or from the latest release, so "upgrade" is always the remedy.

Hardening this repository already applies

Every uses: in .github/workflows/ is pinned to a full commit SHA, and Dependabot moves those pins (.github/dependabot.yml).
CI jobs default to a read-only GITHUB_TOKEN (permissions: contents: read); only the release-attach job is granted contents: write.
The plugin bundle is scanned on every push and pull request by .github/workflows/plugin-scanner.yml.
The approval hook (hooks/approve-cli.sh) auto-approves only a plain cargo-ai invocation, and never one that chains, redirects, or substitutes another program. Login/logout, token minting, report egress, and cdk deploy/destroy are gated back to the normal approval prompt, as is any invocation carrying a destructive verb.