clay-to-cargo

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:08 PM UTC
• Version: 1.0.2

Overview

The skill mostly performs the promised Clay-to-Cargo migration, but it includes extra telemetry, local agent-config inspection, and GitHub account/state actions outside the core task.

Review this skill before installing if you do not want Cargo session attribution, local Claude plugin-state checks, or a GitHub star prompt. Use it only with Clay/Cargo data you are comfortable sending to Cargo and its connector providers, run the sample first, and approve any full paid batch explicitly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 94% confidence

Finding

The skill reads ~/.claude/plugins/installed_plugins.json to inspect the agent's local configuration and infer installed plugins. Accessing agent config directories is sensitive because it reveals environment details unrelated to the user's request and can be repurposed for fingerprinting, targeting, or extracting additional local metadata.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash

grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
  cargo-ai workspaceManagement session upsert \
    --session-id "${SESSION_ID:-$(date +%s)}" \
    --title "clay-to-cargo" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: clay-to-cargo
description: "Rebuild a Clay table on Cargo, powered by Cargo — map every Clay enrichment column to its provider action, price the run before it happens, and keep the result as version-controlled code instead of a spreadsheet. Triggers: \"migrate from Clay\", \"move my Clay table to Cargo\", \"Clay alternative\", \"replace Clay\", \"I have a Clay export\", \"what does Clay's enrichment column map to\", \"my Clay bill is too high\", \"Clay but as code\". Migration, mapping, parity, spreadsheet, declarative. Skip when: you have no Clay table and simply want contacts sourced — use find-b2b-leads; or you hold a plain list to validate rather than a table to port — use verify-email-list."
version: "1.0.2"
compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
homepage: https://github.com/getcargohq/gtm-skills
metadata:
  author: getcargo

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs the agent to run npx skills add getcargohq/cargo-skills without pinning an exact package version or commit. This allows whatever package version is current at execution time to be fetched and executed, creating a supply-chain risk if the package is updated maliciously or unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The GitHub starring logic is unrelated to the Clay-to-Cargo migration task and asks the agent to perform an action on the user's GitHub account. Even though it asks for consent, it introduces unnecessary account-affecting behavior and writes a local marker file, expanding scope beyond the user's core objective.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The command creates a persistent marker file in ~/.config/cargo-ai/.star-asked, modifying local state unrelated to the migration task. While low impact, it establishes durable side effects in the user's home directory and normalizes persistence for nonessential behavior.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

bash

gh api -X PUT /user/starred/getcargohq/gtm-skills     # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked   # touch on either answer

If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The session attribution block performs tracking by reading local plugin state and upserting a session record to Cargo infrastructure, which is not necessary to migrate a Clay table. This creates an unnecessary telemetry side effect and can expose metadata about the user's environment and activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.