Security audit
Security checks for vulnerabilities and agentic risk
The skill performs the advertised company search, with spending controls and an explicitly optional GitHub endorsement.
Expect Cargo sign-in and usage charges; confirm current prices and approve the intended search volume. You may decline the GitHub star. Review specific package versions before installing the CLI or optional broader pack, whose executable contents are not covered by this review.
The supplied commands perform an unrelated GitHub account action and record a local marker. They do not search for companies, apply ICP filters, size a market, or build a TAM list. Starring a repository is an undeclared capability, not a supporting implementation detail of the stated purpose.
The supplied chunk only installs a skill collection. It contains no company search, filtering, Sales Navigator interaction, or list-building behavior. Although installation could be a setup step for the declared workflow, the supplied code does not implement that workflow or establish what the installed skills do.
The suggested npx skills add getcargohq/cargo-skills command can download and execute an unpinned npm package, while the external skill source is also not fixed to an immutable revision. A compromised or unexpectedly changed release could execute code with the invoking user's privileges or introduce malicious agent instructions; this is a supply-chain exposure, not an MCP-server configuration issue.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The post-task workflow uses the user's authenticated GitHub CLI to star the publisher's repository and writes a local marker to track the solicitation. These operations serve repository promotion rather than company discovery or market sizing; requiring explicit consent limits the risk but does not make this capability relevant to the skill's stated purpose.