ask-cargo

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:12 PM UTC
• Version: 0.2.3

Overview

This Slack-facing GTM agent is mostly coherent, but it needs review because broad Slack/repository access is controlled mainly by prompts, and one prompt rule lets mutable repository instructions override its safety rules.

Review before installing. Change the repository-instruction precedence so repo files cannot override safety, approval, secrecy, Slack, or destructive-action rules; keep the bot out of shared/customer channels or switch to explicit channel IDs; pin the Cargo CLI version; and verify the service user remains viewer-only with all changes landing as PRs, not deploys or merges.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: infra/agents/ask-cargo.prompt.ts:18

Finding

Mutable Repository Instructions Can Override the Agent's Security Policy

Content

View full analysis

Vulnerability Details

File Location: infra/agents/ask-cargo.prompt.ts, lines 18–19
Vulnerability Type: Instruction-precedence vulnerability
Risk Level: High

Complete Code Snippet

typescript

Read AGENTS.md (or CLAUDE.md) first for the repository's conventions.
Repository conventions win over anything in this prompt.

Technical Analysis

The agent is explicitly instructed to treat mutable AGENTS.md or CLAUDE.md repository content as higher priority than the remainder of its deployed system prompt. This creates a prompt-injection boundary violation: a repository contributor can modify one of these files after deployment and provide instructions that supersede the Skill's security controls.

The lower-priority controls include the requirement to obtain approval before actions that spend, send, or wake another agent; restrictions on Slack tools; prohibitions against exposing secrets; and limitations on destructive or deployment operations. Although the configured viewer service role prevents some workspace-level administrative changes, it does not technically enforce all of these controls. The harness still has access to a repository write path, Slack-supplied tools, repository and workspace data, a short-lived Cargo session, and approved CLI operations.

This is a reachable vulnerability rather than evidence of malicious authorship. The surrounding project attempts to establish confirmation gates and least privilege, but the unconditional precedence statement undermines those protections.

Attack Path

1. An attacker with permission to commit to the bound repository adds malicious instructions to AGENTS.md or CLAUDE.md.
2. A Slack user mentions the deployed agent, causing a new harness run against the repository checkout.
3. The agent reads the attacker-modified instruction file as required.
4. The quoted precedence rule tells the agent that those instructions override the rest of the Skill prompt.
5. The injected inst ...[truncated 965 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional statement that repository conventions override the entire system prompt.
• Restrict repository conventions to non-security concerns, such as formatting, test commands, directory layout, and contribution workflow.
• Add an explicit immutable precedence rule stating that repository files and retrieved content cannot override authorization, confidentiality, confirmation, channel, tool-use, or destructive-action restrictions.
• Treat AGENTS.md, CLAUDE.md, and all other checkout content as untrusted data when interpreting operational instructions.
• Enforce critical controls outside the language-model prompt:
  • Limit Slack tools to the summoning thread at the platform or capability layer.
  • Represent confirmation as verified application state bound to the exact proposal, record count, action, and maximum cost.
  • Exclude credentials and environment secrets from model-accessible contexts.
  • Maintain the viewer service role and further minimize CLI operations and connector permissions.
  • Restrict repository writes to dedicated branches and enforce protected branches and mandatory pull-request review on GitHub.
• Add a contract test that rejects prompts assigning higher precedence to mutable repository content.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description is for a full Slack-facing GTM orchestrator agent with multiple operational capabilities. The supplied code chunk only defines an Anthropic connector configuration (defineConnector) and selects the default workspace connector for deployment/runtime billing. This is an infrastructure/configuration fragment, not the described agent behavior. While connector setup could support such an agent, the actual code shown does not implement the declared primary purpose and lacks the described triggers and resource interactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says captures 'read only that thread' while also admitting the available Slack tools have no channel lock. That means the restriction is policy-only, not capability-enforced; if the model is prompted off-policy or misbehaves, it may read other channels or threads accessible to the connector, creating a data exposure risk across the workspace.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README makes a strong safety claim that the agent 'posts nothing itself,' but later acknowledges direct Slack tool access and permits reactions/thread reads during capture. This kind of contradictory documentation can lead operators and reviewers to underestimate the agent's real capabilities, weakening oversight and increasing the chance of unsafe deployment or abuse if prompt constraints fail.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 98)May include surrounding context.

md

## What it does not do

It does not deploy, merge, destroy or remove anything, mint tokens, change members, post to any
channel but the thread it was asked in, send to people the workspace has no consent basis for, or
run anything that spends without a go in the thread.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · infra/agents/ask-cargo.prompt.ts (reported line 130)May include surrounding context.

ts

## What it does not do

It does not deploy, merge, destroy or remove anything, mint tokens, change members, post to any
channel but the thread it was asked in, send to people the workspace has no consent basis for, or
run anything that spends without a go in the thread.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation describes a Slack-triggered agent that can answer from repository/workspace context, open pull requests, and invoke cargo-ai commands, but the manifest does not declare any explicit tool scope or allowed-tools boundary. For a skill with networked Slack/GitHub/LLM interactions and CLI-driven external actions, missing scope declarations increases the risk of over-broad runtime capabilities and makes review/enforcement of least privilege difficult.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest includes many broad natural-language trigger phrases such as 'one agent on top of all the others' and 'a slack bot that knows our repo', which can overlap with ordinary requests and cause accidental activation or misuse. In a skill that can create PRs, read sensitive GTM context, and orchestrate other agents, ambiguous activation increases the chance of unintended execution and data exposure.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Derive before you ask.** An input with a lookup is looked up, not asked.

| Input                                                     | Kind  | How it is answered                                                                                                                                                                                                                                                | Why it matters                                                                                                                                                                                                                  |
| --------------------------------------------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| repository binding (`infra/agents/ask-cargo.ts`)          | value | **derived**: `repository` declares only `runAs`, so `plan` binds the project's own repository from the git origin of the checkout, with the project's GitHub connector. `cargo-ai project check` prints what it resolved: confirm it names your repo and the root, not `infra/`.                               | This is the checkout every answer reads and every pull request opens against. An `owner/name` typed by hand is the value nobody notices is wrong until a pull request lands on a stranger's repository.                         |
| service user (`infra/users/index.ts`)                     | value | **derived**: `ask_cargo`, a service user on the adopted `viewer` system role. Deploying creates it; the deploying user's own role must cover 
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Derive before you ask.** An input with a lookup is looked up, not asked.

| Input                                                     | Kind  | How it is answered                                                                                                                                                                                                                                                | Why it matters                                                                                                                                                                                                                  |
| --------------------------------------------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| repository binding (`infra/agents/ask-cargo.ts`)          | value | **derived**: `repository` declares only `runAs`, so `plan` binds the project's own repository from the git origin of the checkout, with the project's GitHub connector. `cargo-ai project check` prints what it resolved: confirm it names your repo and the root, not `infra/`.                               | This is the checkout every answer reads and every pull request opens against. An `owner/name` typed by hand is the value nobody notices is wrong until a pull request lands on a stranger's repository.                         |
| service user (`infra/users/index.ts`)                     | value | **derived**: `ask_cargo`, a service user on the adopted `viewer` system role. Deploying creates it; the deploying user's own role must cover 
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

| Input                                                     | Kind  | How it is answered                                                                                                                                                                                                                                                | Why it matters                                                                                                                                                                                                                  |
| --------------------------------------------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| repository binding (`infra/agents/ask-cargo.ts`)          | value | **derived**: `repository` declares only `runAs`, so `plan` binds the project's own repository from the git origin of the checkout, with the project's GitHub connector. `cargo-ai project check` prints what it resolved: confirm it names your repo and the root, not `infra/`.                               | This is the checkout every answer reads and every pull request opens against. An `owner/name` typed by hand is the value nobody notices is wrong until a pull request lands on a stranger's repository.                         |
| service user (`infra/users/index.ts`)                     | value | **derived**: `ask_cargo`, a service user on the adopted `viewer` system role. Deploying creates it; the deploying user's own role must cover viewer.                                                                     
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

| service user (`infra/users/index.ts`)                     | value | **derived**: `ask_cargo`, a service user on the adopted `viewer` system role. Deploying creates it; the deploying user's own role must cover viewer.                                                                                                               | Every turn's `cargo-ai` session. Viewer reads runs, models, agents and usage and can message other agents, but cannot deploy or change a resource, so the prompt's limits hold even when the prompt is ignored.               |
| Slack, GitHub and LLM connectors (`infra/connectors/`)    | value | **derived**: `cargo-ai connection connector list` shows what is authorized; `cargo-ai project add connector/<slack\|github\|anthropic>` opens the consent for what is missing. All three are `default: true` because a deploy cannot mint a grant.                      | Slack is the trigger, GitHub the only write path, Anthropic what every turn is billed against. A harness paired with a non-Anthropic connector typechecks green and fails at deploy.                                            |
| channel reach (`infra/agents/ask-cargo.ts`)               | value | **derived**: `allChannels: true`, so the reach is every channel the bot is in. Read them from the Slack connector's channel autocomplete; `cargo-ai ai agent list` shows which other agents list channels of their own.                                            | The agent reads the ICP, the pipeline and the spend out loud to whoever is in the channel. A customer shared channel the bot is in leaks all of it. A channel another agent lists stays that agent's, and a second `allChannels` agent answers alongside this one. |
| roster (`references/roster.md`)                           | value | **derived**: `cargo-ai ai agent list` for what is deployed, each agent's description for what it owns.                                                                                                                       
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

| service user (`infra/users/index.ts`)                     | value | **derived**: `ask_cargo`, a service user on the adopted `viewer` system role. Deploying creates it; the deploying user's own role must cover viewer.                                                                                                               | Every turn's `cargo-ai` session. Viewer reads runs, models, agents and usage and can message other agents, but cannot deploy or change a resource, so the prompt's limits hold even when the prompt is ignored.               |
| Slack, GitHub and LLM connectors (`infra/connectors/`)    | value | **derived**: `cargo-ai connection connector list` shows what is authorized; `cargo-ai project add connector/<slack\|github\|anthropic>` opens the consent for what is missing. All three are `default: true` because a deploy cannot mint a grant.                      | Slack is the trigger, GitHub the only write path, Anthropic what every turn is billed against. A harness paired with a non-Anthropic connector typechecks green and fails at deploy.                                            |
| channel reach (`infra/agents/ask-cargo.ts`)               | value | **derived**: `allChannels: true`, so the reach is every channel the bot is in. Read them from the Slack connector's channel autocomplete; `cargo-ai ai agent list` shows which other agents list channels of their own.                                            | The agent reads the ICP, the pipeline and the spend out loud to whoever is in the channel. A customer shared channel the bot is in leaks all of it. A channel another agent lists stays that agent's, and a second `allChannels` agent answers alongside this one. |
| roster (`references/roster.md`)                           | value | **derived**: `cargo-ai ai agent list` for what is deployed, each agent's description for what it owns.                                                                                                                       
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

The code is a worked example. These reshapes are expected, and the agent offers them rather than
waiting to be asked. Every one costs something.

| Variation             | When it is right                                                                                     | How                                                                                                                                                                                                  | What it costs                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: 
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

The code is a worked example. These reshapes are expected, and the agent offers them rather than
waiting to be asked. Every one costs something.

| Variation             | When it is right                                                                                     | How                                                                                                                                                                                                  | What it costs                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: 
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md

The code is a worked example. These reshapes are expected, and the agent offers them rather than
waiting to be asked. Every one costs something.

| Variation             | When it is right                                                                                     | How                                                                                                                                                                                                  | What it costs                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: 
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

| Variation             | When it is right                                                                                     | How                                                                                                                                                                                                  | What it costs                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: ["C…"]` in `infra/agents/ask-cargo.ts`, from the connector's autocomplete                                                                         
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

| Variation             | When it is right                                                                                     | How                                                                                                                                                                                                  | What it costs                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: ["C…"]` in `infra/agents/ask-cargo.ts`, from the connector's autocomplete                                                                         
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

| Variation             | When it is right                                                                                     | How                                                                                                                                                                                                  | What it costs                                                                                                                                                                                                                         |
| --------------------- | ---------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: ["C…"]` in `infra/agents/ask-cargo.ts`, from the connector's autocomplete                                                                         
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

| `answer-only`         | You want a Slack oracle over the repo first, and no one running anything from Slack yet              | In `infra/agents/ask-cargo.prompt.ts`, replace §3 and §4 with "propose the command, never run it"                                                                                                    | The team copies commands out of Slack into a terminal, and "the agent said it would cost X" stops being checked against what actually ran.                                                                                            |
| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: ["C…"]` in `infra/agents/ask-cargo.ts`, from the connector's autocomplete                                                                            | A list to keep in sync: a new team channel gets no answer until someone edits the file and deploys. Listing a channel also takes it from any `allChannels` agent.                                                                  |
| `dms-too`             | Individuals want to ask privately                                                                    | Add each person's Slack **user id** (`U…`) to `channelIds` next to `allChannels`; DMs are listed by user, not by `D…` channel, and `allChannels` never covers them.                                   | The thread stops being multiplayer: nobody else sees the proposal or the go, so a DM go is one person approving spend alone. Keep §3 unchanged if you take this.                                                                    |
| `master-agent-slack`  | You only need questions answered, no repo and no pull requests                                       | Skip this cookbook. Put a Slack trigger on the workspace's built-in Master Agent in the UI.                                                                                                          |
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

| `listed-channels`     | The bot sits in channels it must never answer in, or you want answers in a few channels only        | Replace `allChannels: true` with `channelIds: ["C…"]` in `infra/agents/ask-cargo.ts`, from the connector's autocomplete                                                                            | A list to keep in sync: a new team channel gets no answer until someone edits the file and deploys. Listing a channel also takes it from any `allChannels` agent.                                                                  |
| `dms-too`             | Individuals want to ask privately                                                                    | Add each person's Slack **user id** (`U…`) to `channelIds` next to `allChannels`; DMs are listed by user, not by `D…` channel, and `allChannels` never covers them.                                   | The thread stops being multiplayer: nobody else sees the proposal or the go, so a DM go is one person approving spend alone. Keep §3 unchanged if you take this.                                                                    |
| `master-agent-slack`  | You only need questions answered, no repo and no pull requests                                       | Skip this cookbook. Put a Slack trigger on the workspace's built-in Master Agent in the UI.                                                                                                          | No checkout: it cannot read `infra/` or `cadence/`, and it cannot change anything. Cheaper and faster per question, because there is no sandbox to start.                                                                           |
| `no-handoff`          | No other agents are deployed yet                                                                     | Delete §4 of the prompt and `references/roster.md`                                                                                                                                                   | E
...[truncated 26 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

| `dms-too`             | Individuals want to ask privately                                                                    | Add each person's Slack **user id** (`U…`) to `channelIds` next to `allChannels`; DMs are listed by user, not by `D…` channel, and `allChannels` never covers them.                                   | The thread stops being multiplayer: nobody else sees the proposal or the go, so a DM go is one person approving spend alone. Keep §3 unchanged if you take this.                                                                    |
| `master-agent-slack`  | You only need questions answered, no repo and no pull requests                                       | Skip this cookbook. Put a Slack trigger on the workspace's built-in Master Agent in the UI.                                                                                                          | No checkout: it cannot read `infra/` or `cadence/`, and it cannot change anything. Cheaper and faster per question, because there is no sandbox to start.                                                                           |
| `no-handoff`          | No other agents are deployed yet                                                                     | Delete §4 of the prompt and `references/roster.md`                                                                                                                                                   | Every job is redone by this agent from scratch, without the owning agent's rules. Add §4 back the day the first pipeline deploys.                                                                                                    |
| `higher-sample-bar`   | Your runs are expensive per record, or touch people                                                  | Lower the 25-record threshold and the 5-record sample in §3 of the prompt                                                                                                                          
...[truncated 25 chars]

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

| `dms-too`             | Individuals want to ask privately                                                                    | Add each person's Slack **user id** (`U…`) to `channelIds` next to `allChannels`; DMs are listed by user, not by `D…` channel, and `allChannels` never covers them.                                   | The thread stops being multiplayer: nobody else sees the proposal or the go, so a DM go is one person approving spend alone. Keep §3 unchanged if you take this.                                                                    |
| `master-agent-slack`  | You only need questions answered, no repo and no pull requests                                       | Skip this cookbook. Put a Slack trigger on the workspace's built-in Master Agent in the UI.                                                                                                          | No checkout: it cannot read `infra/` or `cadence/`, and it cannot change anything. Cheaper and faster per question, because there is no sandbox to start.                                                                           |
| `no-handoff`          | No other agents are deployed yet                                                                     | Delete §4 of the prompt and `references/roster.md`                                                                                                                                                   | Every job is redone by this agent from scratch, without the owning agent's rules. Add §4 back the day the first pipeline deploys.                                                                                                    |
| `higher-sample-bar`   | Your runs are expensive per record, or touch people                                                  | Lower the 25-record threshold and the 5-record sample in §3 of the prompt                                                                                                                          
...[truncated 25 chars]

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The prompt requires every reply that needs approval to end with the exact English phrase "Mention me again with go to run it." This imposes a specific language/locale behavior on all users and does not offer any language choice or opt-in, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The prompt instructs the agent to execute npx --yes @cargo-ai/cli without a pinned version, which can fetch and run whatever package version is current at execution time. In an agent with repository, Slack, and workspace access, a compromised or unexpectedly changed package could alter behavior, exfiltrate data, or perform unintended actions before the user notices.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · infra/agents/ask-cargo.prompt.ts (reported line 61)May include surrounding context.

ts

fails, this sandbox has no Cargo session: say so, and answer from the
   repository alone.

These workspace reads are free to run without asking:

- \`cargo-ai orchestration run count\` / \`run list\` / \`run get <uuid>\`
- \`cargo-ai orchestration batch list\` / \`batch get <uuid>\`