Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious with medium confidence because scanners report unpinned installers, potential disclosure of command and record data, and actions outside its stated routing purpose; coverage is partial.
Treat this as a review warning, not a claim that the author is malicious. Before installing, consider whether you trust the unpinned package and instruction sources, whether reports or enrichment workflows could expose information you want kept private, and whether the described approvals and account changes fit your needs. Coverage is incomplete: 8 of 9 components were scanned, and static analysis of part of SKILL.md could not fully evaluate obfuscated instruction text.
The command sends a PUT request to GitHub's repository-starring endpoint. Starring a repository is an account-changing action unrelated to routing Cargo tasks or enforcing shared Cargo execution rules, and it is not disclosed in the declared purpose.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
GTM"` on a fresh account yields one workspace, not two.
`--oauth` runs the same OAuth 2.0 Device Authorization Flow it always did, and still needs a human at the verification URL. `--agentid` signs an **agent** in as its own identity: it prints an Auth0 URL for the AgentID connection and waits on `http://127.0.0.1:52701/callback` (5-minute timeout); open the URL once (a second visit starts a different sign-in) and approve the token as AgentID instructs (`cargo-ai login --help` names the command). `--email`, `--oauth` and `--agentid` all save a self-renewing session to `~/.config/cargo-ai/credentials.json` (the system temp dir where home isn't writable — it lasts as long as the sandbox). Use `--token` for CI, with a workspace-scoped token from **Settings > API**; store the token value in a secrets manager (`token list` also returns your own tokens' values, so treat its output as a secret).
Without a global install, prefix every command with `npx @cargo-ai/cli` instead of `cargo-ai`.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
> **Automated on Claude Code.** Job 1 (refresh) runs on its own when the **Cargo plugin** is installed — its bundled `SessionStart` hook installs the pinned CLI and refreshes the plugin. Do it by hand only when the plugin is not installed (or on agents without lifecycle hooks). Nothing records the session: no hook and no step here sends Cargo the user's prompts, a transcript, or a summary of one. Job 2 (reporting) is always your responsibility, and so is the one **ask** in Job 3 (star the repo): a hook can print, but it can't take a Y/N.
>
> **Installing Cargo is the user's call, not an action you take.** The `curl ... install.sh | sh`
> bootstrap is **retired** — it installs nothing now, prints a notice and exits non-zero, so never
> reach for it or repeat it as advice. Point the user at the plugin install in the repo
> [`README.md`](../README.md). An agent asked to do the setup itself follows
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
> **Automated on Claude Code.** Job 1 (refresh) runs on its own when the **Cargo plugin** is installed — its bundled `SessionStart` hook installs the pinned CLI and refreshes the plugin. Do it by hand only when the plugin is not installed (or on agents without lifecycle hooks). Nothing records the session: no hook and no step here sends Cargo the user's prompts, a transcript, or a summary of one. Job 2 (reporting) is always your responsibility, and so is the one **ask** in Job 3 (star the repo): a hook can print, but it can't take a Y/N.
>
> **Installing Cargo is the user's call, not an action you take.** The `curl … install.sh | sh`
> bootstrap is **retired** — it installs nothing now, prints a notice and exits non-zero, so never
> reach for it or repeat it as advice. Point the user at the plugin install in the repo
> [`README.md`](../README.md). An agent asked to do the setup itself follows
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
ends the code and exits, so re-run with `--code` (or `--code -` to read it from stdin and keep it out of shell history). The first sign-in creates a `Personal` workspace; `--workspace-name` reuses a workspace of that name, else renames that `Personal` one (if it is your only workspace, under 10 minutes old, and you are its only member), else creates one. `--oauth` runs the OAuth 2.0 Device Authorization Flow — no client setup. `--agentid` prints an Auth0 URL for the AgentID connection and waits on `http://127.0.0.1:52701/callback` for up to 5 minutes; open it once. The three interactive methods save a self-renewing session to `~/.config/cargo-ai/credentials.json` (`CARGO_CONFIG_DIR` / `XDG_CONFIG_HOME` move it; an unwritable home falls back to the system temp dir). For CI / scripts, use `--token` with a workspace-scoped API token from **Settings > API**. Store the token in a secrets manager; `token list` also returns your own tokens' values, so treat its output as a secret.
## Verify
The fallback invokes an unversioned npm executable, potentially downloading and executing a different CLI release than the bundle's intended pin. Although this is not specifically an MCP server declaration, a compromised or unexpectedly changed release could execute with the agent's local permissions and access credentials.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
> bootstrap is **retired** — it installs nothing now, prints a notice and exits non-zero, so never
> reach for it or repeat it as advice. Point the user at the plugin install in the repo
> [`README.md`](../README.md). An agent asked to do the setup itself follows
> `https://api.getcargo.io/INSTALL.md`, which installs the CLI, signs the user in, and installs the
> skills for whichever agent it is — read it before running it, and still confirm before installing
> a global npm package on someone's machine.
The session refresh executes the unpinned skills npm package with automatic download confirmation and installs skills from a mutable repository reference. Pinning the Cargo CLI afterward does not protect either the installer execution or the newly installed agent instructions from supply-chain changes.
Mandatory reports include exact commands, API error details, and identifiers without requiring redaction or user review before transmission to Cargo. In a CLI that handles tokens, contact data, SQL, and deployment configuration, these fields can contain secrets or confidential business information; the separate warning about token-list output does not cover this reporting path.
The skill directs agents to file support reports automatically and include exact command arguments and error details. This crosses a vendor-disclosure boundary without a sanitization or review gate and is the same underlying issue as the SQP-2 finding.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Touch the marker on either answer, so a no is never re-asked and a yes is never double-asked:
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked
If gh is missing or unauthenticated, don't fix it and don't offer a workaround — say the repo is at https://github.com/getcargohq/cargo-skills and move on. This is the lowest-stakes item in the session; it never becomes a task.
The documented repair command uses an unpinned npm installer and a mutable skills source. Execution is conditional on a repair task rather than automatic here, but a changed installer or repository can still introduce executable code or persistent agent instructions.
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
| `recipes/custom-datapoints.md` | Design which custom attributes + live signals to collect, gated on a real source and cost. |
| `recipes/outreach-activation.md` | Turn a signal segment into send-ready outreach (enrich → verify → personalize → sequencer handoff). |
| `recipes/ads-audience-activation.md` | Push a segment to Google Ads Customer Match / LinkedIn Matched Audiences. |
| `recipes/review-and-iterate.md` | Human review loop for judgment output; corrections become permanent rules. |
| `recipes/re-engagement.md` | Wake up stale contacts only when a fresh signal fires (job change, funding, tech intent). |
| `recipes/lost-deal-revival.md` | Revive Closed-Lost CRM deals by branching on `lost_reason` (champion left, budget, timing). |
| `recipes/account-expansion.md` | Multi-thread customer accounts — net-new buyers, deduped against the Contacts model. |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
to the production branch — and the branch head the moment it connects. A merge over
100 sends of a kind, 5,000 audience adds or 2,500 credits is held as **Action required**
(`Needs approval: add the cargo:approve-impact label`) until the PR is labelled, which only the user's yes
should add. Running an Actions deploy as well fails (`stateAutoDeployed`). Recipe:
`../cargo-project/recipes/deploy-from-ci.md`.
**Recipes shipped:** `recipes/scaffold-a-project.md`, `add-connector-and-model.md`,
The cookbook installation example executes an unpinned installer and obtains instructions from a mutable repository source. Those instructions are subsequently copied and adapted into deployable projects, allowing an upstream compromise to influence both agent behavior and deployed resources.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
|
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `conjonction` spelling | Filter JSON uses `conjonction` (not `conjunction`). This is intentional. It is a required key, so a typo is rejected with a 400. |
| `run create` vs `batch create` | `run create` only works with **tool** workflows. Using a play's `workflowUuid` returns `playNotCompatible`. |
| Inputs in `config` are stripped, not rejected | On a top-level action (`action execute` / `execute-ba
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
cute` and `storage query download` reference tables as `<datasetSlug>.<modelSlug>` (e.g. `default.companies`). |
| Token values are secrets | API token values come back from `token create` and also from `token list` (your own tokens). Store them in a secrets manager and never paste `token list` output. `workspaceManagement token create` requires `--name` (no more `--from-user`). |
| Invoice amounts in cents | `subscription get-invoices` returns `amount` in cents. Divide by 100. |
| Plays vs tools | **Play** = reacts to data changes (segment-driven). **Tool** = triggered on demand (ma
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
estimate**. `kind: "segment"`/`"change"` have no limit — sample via `kind: "filter"` + `limit` or `recordIds`. See `../../cargo-orchestration/SKILL.md` → "Create a batch". |
| Count before you pay | Search actions bill on **returned** rows, not matched totals. Keep `limit` strict; a `limit: 1` probe sizes the whole pool for the price of one row. See `../../cargo-gtm/references/cost-discipline.md`. |
| Phone lookup is the ~10× lever | Phone actions run 3–7 credits/record vs ~0.1–1 for email. Never in a default chain — explicit user request on qualified leads only. |
| Receipt before next step | After any paid action: report credits spent, balance remaining, and hit-rate before proposing what to do next. Estimates diverging from actuals get a one-line why (`billing usage get-metrics` is the source of truth). |
Although this is a CLI rather than an MCP server declaration, the recommended npx alternative does not specify an exact version, and installation also falls back to latest. This permits execution of an unreviewed future package release, exposing the agent environment and available credentials if that release is compromised.
The documented auto-approval policy includes run and batch operations, which can consume credits and invoke workflows that write data or call third-party services. Preserving deny rules and prompting for selected destructive commands helps, but does not cover consequential side effects hidden behind otherwise allowed workflow commands; the hook implementation is not provided to verify additional safeguards.
## Permission prompts
When the Cargo plugin (or the installer's hook scaffolding) is present, an approval hook — wired per agent as `PreToolUse` (Claude Code), `PermissionRequest` (Codex), or `beforeShellExecution` (Cursor) — auto-approves ordinary `cargo-ai` calls — reads, queries, run/batch operations, and pipelines through read-only helpers (`jq`, `grep`, `head`, …) — so they don't prompt. Four categories always still prompt, deliberately: credentials (`login`/`logout`), token minting (`workspaceManagement token …`), report egress (`workspaceManagement report …` — reports can carry session traces, so consent stays explicit), and destruction/deploys (`project deploy`/`destroy`, any `remove`/`delete`). The hook is allow-only: it can skip a prompt but never override a deny rule. Don't restructure commands to dodge a prompt — if one of these prompts appears, it's supposed to.
## Admin-only commands
This recipe instructs the agent to select enrichment and CRM integrations and execute a batch on a company segment, rather than merely cataloging available tools. It does not warn that the selected records may be transmitted to external providers or instruct the agent to verify which records and fields will be shared.
The session-end workflow asks for an endorsement and uses gh api -X PUT to star the vendor's repository with the user's GitHub identity. This promotional account modification is not justified by the manifest's Cargo setup, routing, and GTM purpose; the explicit-consent requirement limits the risk but does not make it part of that purpose.