cargo-quickstart

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:42 AM UTC
• Version: 1.0.3

Overview

This Cargo demo skill is mostly purpose-aligned, but it can spend credits and run account-affecting workflows with too little explicit confirmation and uses an unpinned CLI install path.

Review this skill carefully before installing. It is not evidence of malware, but you should only use it when you intentionally want a Cargo lead-sourcing demo, and you should confirm the exact credit spend, provider, workspace, and any recurring play before allowing commands to run. Prefer a pinned Cargo CLI version if available.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes broad phrases such as 'give me a demo' and 'quickstart', which can cause the skill to activate in contexts where the user did not specifically intend this workflow. Because this skill can lead to paid external actions and account writes, accidental invocation increases the chance of unintended spending or operations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `npx @cargo-ai/cli`, which resolves the latest package at execution time rather than a pinned, reviewed version. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched and executed implicitly during the demo flow.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **No discovery detours.** Do not run `cargo-ai --version`, `cargo-ai whoami`, `connection connector list`, or any exploratory command first. Auth problems will surface as errors on the first real call — handle them then.
- **One command block per step**, no narration between commands.
- **Paid work is capped at ~1 credit total.** The demo uses the cheapest sourcing action in the catalog (`salesNavigator.searchLeads`, 0.02/record → 25 records ≈ 0.5 credits). Nothing else paid runs without asking.
- **Never dead-end.** Every step has a fallback (ladder below). If a rung fails, drop one rung silently and keep moving.

## Fast path

• Confidence: 94% confidence
• Finding: The skill explicitly directs the agent to make operational decisions and continue through a fallback ladder 'silently' without asking, while the workflow includes paid third-party actions and potential writes. In context, that autonomy is dangerous because it can trigger external calls, consume credits, and change execution paths without meaningful user consent at each step.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file instructs the agent to ask exactly one question and explicitly forbids asking about output format, volume, or providers. This imposes a rigid interaction style on the user without opt-in, which can be a natural-language policy concern when the skill overrides user preference for how to proceed.

Static analysis

No suspicious patterns detected.