cargo-workspace-management Skill: Users, Tokens, Folders and Reports in Cargo

Lets Claude administer a Cargo workspace: invite members, set roles, mint and rotate API tokens, organize folders, store env vars and file reports.

Installs: 10.5K; on skills.sh
Stars: 21; on GitHub
Files: 8; besides SKILL.md
Updated: Oct 2026; last repo commit

Claude uses cargo-ai workspaceManagement commands for the admin side of Cargo: list and invite users, change roles, grant or deny access to one resource, create and remove API tokens, and manage folders. It also stores workspace environment variables (with a secret option), uploads CSVs for batch runs, and files reports to the Cargo team.

SKILL.md says user, role and environment variable writes need admin access. It needs the Cargo CLI and a Cargo sign-in. Credits and invoices belong to cargo-billing.

Good for

Workspace admins inviting teammates and setting roles
Engineers creating an API token for CI or a service user
Teams organizing plays, tools and agents into folders

Install cargo-workspace-management

Claude Code

Copy this prompt.

Install the cargo-workspace-management skill in Claude Code. Run this command:

/plugin marketplace add getcargohq/cargo-skills
/plugin install cargo@cargo-skills

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Every Cargo skill drives the cargo-ai CLI, so install it and sign in first. A new account starts with 100 free credits and no card (README). Pick one channel, not two: the plugin and skills add both register the skills, so using both duplicates them. The whole bundle is the route the README documents; this skill's own files point to files in sibling skills such as ../cargo/references/prerequisites.md. The plugin needs Claude Code 2.1.154 or newer and adds hooks and two subagents; see the safety section.

From the project README. Source.

What's in the skill

When it loads

Administer a Cargo workspace and talk back to the Cargo team — invite and manage members, mint and rotate API tokens, organize plays, tools, and agents into folders, inspect roles, upload batch input files, and file reports. Triggers: "invite my teammate", "create an API token for CI", "who has access", "organize these into folders", "rotate that token", "upload this CSV for a batch" — and for feedback: "report this bug to Cargo", "send feedback to the Cargo team", "this CLI command is broken", "share this session with Cargo", "request a feature". Most commands need a token with admin access. Skip when: the question is about credits, plans, or invoices — use cargo-billing.

Sections in SKILL.md

Bootstrap
Discover resources first
Quick reference
Current user and workspace
Users
Service users
Roles
API tokens
Folders
Reports
Sessions
Environment variables
Workspace files
Help

Key facts

Author: Cargo (frontmatter author: getcargo), in the vendor's own repo
License: MIT (LICENSE, README badge and plugin.json agree)
Version: 1.6.3
Installs on skills.sh: 10,543 (Nov 2, 2026)
GitHub stars: 21 (Nov 2, 2026)
Last commit: Oct 31, 2026
What installs: 9 files including SKILL.md: 7 reference and example files and skill-metadata.json
Needs: The cargo-ai CLI (npm) and a Cargo sign-in; a new account starts with 100 free credits
Cargo CLI license: UNLICENSED on npm; the skills bundle itself is MIT
Bundle size: README and plugin manifests say 19 skills, the skills.sh badge says 18, and the repo has 20 skill folders including a redirect stub
Works in: Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Hermes Agent and other skills.sh agents

What it includes

Shows your user and workspace, lists reachable workspaces and updates the current one.
Runs code · whoami / workspaces
Invites members with a role, changes roles and removes members.
Delete · user create / update / remove
Grants or denies one member access to a single resource.
Runs code · user upsert-permission
Non-human identities with their own role for workers and coding agents.
Runs code · Service users
Creates custom roles from permission statements; built-in roles stay fixed.
Delete · role create / update / remove
Mints, lists and removes API tokens; token values appear in the output.
Delete · token create / list / remove
Creates, renames, moves and removes folders for tools, plays, agents and more.
Delete · folder commands
Files a bug, feedback or session-share report to the Cargo team.
Runs code · report create
Writes a Claude Code session row with a title and summary to the workspace.
Runs code · session upsert
Creates, updates and removes workspace variables; --secret hides the value.
Delete · envVar commands
Uploads a CSV for a batch run and shows its columns.
Runs code · Workspace files

From the official docs

Permissions

High risk

It can grant access, create API tokens and delete admin settings in your Cargo workspace. Use it only with an admin token you trust and review each command.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can grant access and create API tokens
user create, upsert-permission, role and token create change who can act in the workspace. Check the workspace name and the role before you approve. github.com
Token values appear in command output
SKILL.md says token values are returned at creation and again by token list. Treat both outputs as secrets and do not paste them into chat or commit them. github.com
It can remove members, roles, tokens and variables
The remove commands delete access and settings. The plugin hook still prompts for remove and delete, and for token minting. github.com
Reports go to the Cargo team
report create sends a title and description to Cargo. Redact sensitive values from the command text first, as SKILL.md asks. github.com
Claude runs the cargo-ai CLI as you
The skill drives the cargo-ai CLI. Sign-in is saved to ~/.config/cargo-ai/credentials.json, and the docs say to confirm the workspace with cargo-ai whoami before any write. github.com
The plugin route adds hooks that run shell commands
The plugin wires a PreToolUse hook on Bash that auto-approves safe cargo-ai calls, and a SessionStart hook that runs npm install -g @cargo-ai/cli at the pinned version. Login, token creation, report creation, project deploy and any remove or delete still prompt. github.com
The plugin sends a session summary to your Cargo workspace
The SessionEnd hook passes the last 60,000 bytes of the transcript to claude -p to write a title and summary, then stores them in your Cargo workspace session record. Use the skills CLI route if you do not want that. github.com
Inviting by email can add new members
SKILL.md says --emails invites any address that is not a member yet, so check user list first. github.com
The plugin also adds two subagents
cargo-execution-planner and cargo-list-builder run on the haiku model with Read, Grep, Glob and Bash tools. The planner is described as read-only and the list builder as executing only pre-approved slices. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Talks to	api.getcargo.io (Cargo API). registry.npmjs.org (CLI install). app.getcargo.io (token creation)
Sign-in and keys	Sign-in by emailed code, browser (OAuth) or an API token. Browser and email sign-in save a session to ~/.config/cargo-ai/credentials.json; API tokens are workspace-scoped and the README says to store them in a secrets manager.
Scopes	Admin-level workspace changes: users, roles, API tokens, folders, env vars Cargo workspace sign-in (saved in ~/.config/cargo-ai/credentials.json)

Questions

What does cargo-workspace-management do?

It lets Claude run the admin tasks of a Cargo workspace: members and roles, API tokens, folders, environment variables, uploaded batch files and reports to the Cargo team.

Do I need to be an admin?

For user, role and environment variable writes, yes. SKILL.md says those need workspace-management write (admin) access. Any user can create, list and remove their own API tokens, folder writes check folder write permission, and report create and session upsert need no special permission.

Are API token values safe in the output?

Treat them as secrets. SKILL.md says token values are returned at creation and again by token list, and tells you to store them in a secrets manager such as GitHub Secrets or AWS Secrets Manager.

How do I store a secret environment variable?

Create it with --secret. SKILL.md says the value is encrypted at rest and never returned again. Omit --value to have the CLI read the same-named shell variable, which keeps it out of the command line.

What happens when it files a report?

A report goes to workspace management, which SKILL.md calls the official feedback channel reviewed by the Cargo team. The plugin approval hook always prompts for report commands because reports can carry session traces.

What does it have to do with Claude Code sessions?

session upsert records a session row with a title and summary. The Cargo plugin's hooks call it at session start, each turn and session end, as the README describes.

How do I install it?

Use the install box above. Install the whole Cargo bundle, then the Cargo CLI and sign in. The README says to pick one channel, plugin or skills add, not both.

Is it official?

Yes. It sits in Cargo's own repo (getcargohq/cargo-skills), the LICENSE names Cargo as the copyright holder and the plugin manifest lists Cargo as the author.

Does it work in the Claude app, Codex or Cursor?

The README names Claude Code, Codex, Cursor, Windsurf, GitHub Copilot and Hermes Agent. For Claude Desktop it documents a Claude Cowork plugin route with network egress turned on. The skill drives a local CLI, so there is no plain Claude app skill upload here.

Is it safe to use?

It controls who can use your Cargo workspace and creates credentials. User, role, token and env var commands can grant access, hand out API tokens or delete them, and token values show up in command output. Our advice: confirm the workspace with cargo-ai whoami, and give tokens only the access they need.

Information

updated Nov 2, 2026

Repository: getcargohq/cargo-skills
Folder: cargo-workspace-management

getcargohq/cargo-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 7

cargo-skills README · github.com
cargo prerequisites.md · github.com
cargo-workspace-management SKILL.md · github.com
cargo-skills LICENSE · github.com
cargo-skills plugin.json · github.com
session-end.sh · github.com
session-start.sh · github.com