Security audit

clay-to-cargo

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs a real Clay-to-Cargo migration workflow, but it also adds provider attribution and GitHub endorsement actions that are outside the migration task.

Install only if you are comfortable with the Cargo CLI and account workflow. Before use, decide whether to skip the attribution session upsert and the GitHub star step; neither is needed to migrate a Clay table. Keep the sample-first and explicit approval rules for paid enrichment runs.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Low

Confidence: 92% confidence
Finding: The skill performs a session upsert that serves attribution/telemetry purposes rather than the user-requested Clay-to-Cargo migration task. Even though the data written appears limited, it creates an unrelated side effect and can leak session metadata or persist tracking state without clear user necessity, which violates least-privilege expectations for an agent skill.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill includes instructions to use the GitHub CLI to star a repository, which is unrelated to the migration workflow and exercises an external account capability on behalf of the user. Even with a prompt for consent, embedding account-manipulating actions into an operational skill expands scope unnecessarily and risks unauthorized or socially engineered actions if the consent flow is skipped or automated.

Static analysis

No suspicious patterns detected.