cargo-mailbox-management

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:21 PM UTC
• Version: 1.3.1

Overview

The skill matches its mailbox-management purpose, but it should be reviewed before installation because it can send real emails, spend credits, use Cargo credentials directly, and installs an unpinned CLI.

Install only if you trust Cargo and the current `@cargo-ai/cli` package, and prefer a pinned CLI version. Treat this skill as having authority to send real email, affect recipients, create or remove paid mailbox infrastructure, and read reply/event data. Do not expose the Cargo access token from `~/.config/cargo-ai/credentials.json`, and require explicit human approval before mailbox/domain purchases or batch sends.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The document explicitly tells operators where an access token is stored on disk (~/.config/cargo-ai/credentials.json). While it does not reveal the token value itself, exposing credential locations lowers the barrier for credential theft by malware, malicious local users, or downstream tooling that may scrape known paths. In a skill that manages domains and outbound email infrastructure, stolen credentials could enable unauthorized domain purchases, mailbox provisioning, and sending operations.

Content

Scanner excerpt · references/sending-domains.md (reported line 22)May include surrounding context.

-> { "result": { "name": "tryacme.com", "available": true, "priceCredits": 1200 } }

text

The token is in `~/.config/cargo-ai/credentials.json` after `cargo-ai login`.

**`priceCredits: null` does not mean free.** It means the domain is not purchasable through Cargo:
either unavailable, or premium-priced above the configured ceiling. Read `null` as unavailable.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx @cargo-ai/cli, which fetches and executes the latest published package at runtime without a pinned version. That creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users of the skill may execute unreviewed code immediately.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/response-shapes.md (reported line 24)May include surrounding context.

md

| `pricing get` | `{ monthlyCredits: Record<MailboxType, number> }` | — | — | — |

**Two traps.** `mailbox list` is the only list with no `count` — count the array. And `mailbox
list` / `suppression list` have no default limit, so an unbounded call returns everything up to
1000 while the other three quietly stop at 50.

There is no `event get`. Fetch events through `event list --message-uuid` or `--thread-uuid`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents a live sendEmail invocation and helper usage without an immediate, prominent warning at the example itself that execution will actually deliver email. In a skill whose purpose is mailbox provisioning and outbound sending, users may copy-paste the command or code snippet directly, causing unintended real outreach, billing, compliance violations, or accidental contact with external recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The instruction "Stay on .com" is a natural-language rule that forces a specific naming/locale-related convention rather than offering user choice. Under the policy, language or locale-style constraints should either be optional or clearly justified as region-specific; here it is presented as a blanket rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.