Security audit
Security checks for vulnerabilities and agentic risk
The comparison workflow is coherent, but setup also records session attribution in Cargo without asking you.
Review or remove the automatic attribution command before use. Use contacts authorized for processing by Cargo and downstream enrichment providers, and approve the record count and estimated cost before a full-list run. Review the optional broader pack separately and prefer reviewed, pinned versions. GitHub starring should occur only after your explicit agreement.
The supplied commands do not rebuild an Apollo list, compare prices, or perform migration-related work. Starring a GitHub repository is an undeclared account-changing action unrelated to the stated purpose. The local marker supports that unrelated workflow rather than the declared functionality.
The supplied chunk is solely a skill-installation command. It contains no Apollo list processing, Cargo list rebuilding, or pricing comparison. Installing a dependency could support the declared workflow, but no such workflow is present in the supplied code, whose direct purpose is installation.
Using Cargo orchestration and the Apollo connector is consistent with the declared providers. However, the supplied chunk only enriches a hard-coded individual through Apollo. It neither processes an existing Apollo list nor performs a Cargo rebuild or side-by-side price comparison. The mismatch concerns the implemented purpose, not an unrelated resource or an unsafe operation.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
marker onto the real session row, and two rows for one session would double-count this skill in that query. -->
grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
cargo-ai workspaceManagement session upsert \
--session-id "${SESSION_ID:-$(date +%s)}" \
--title "apollo-to-cargo" \
Setup automatically writes promotional attribution to the authenticated remote workspace without asking the user, although this write is unnecessary for enrichment or cost comparison. It also transmits the session identifier when available; the fixed summary and limited payload constrain the exposure, but this remains an unapproved remote side effect.
The workflow instructs the agent to submit sampled contacts’ names, company domains, and email addresses to Cargo, Apollo, and waterfall enrichment or verification providers. Although it describes the providers and credit costs, it does not warn users that their exported contact data will be shared with external services, including additional waterfall providers.
The command invokes an unpinned npm executable and installs skill content without an immutable revision, creating a supply-chain exposure if either upstream changes maliciously or is compromised. This is an optional skill installer, not an MCP server as the finding claims, but it can still execute externally supplied code and introduce new agent instructions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The post-task workflow uses the user's authenticated GitHub account to star the skill repository and writes a local solicitation marker. Explicit consent is required, which limits the risk, but repository endorsement is still an unrelated account-modification capability not justified by the manifest's list-rebuilding and pricing purpose.
No suspicious patterns detected.