Security audit
Security checks for vulnerabilities and agentic risk
The skill’s company-enrichment workflow fits its purpose, with disclosed external services, spending controls, and an optional GitHub star requiring explicit consent.
Use company domains approved for sharing with Cargo and aiArk, and review the sample results and estimated cost before approving the full batch. Prefer reviewed dependency versions and separately review the optional larger skill pack. You can decline the GitHub star. This assessment covers the bundled instructions, not the external CLI, recipe, or optional pack.
The supplied code performs a GitHub account action and records a local marker; it does not enrich company data. Starring a repository is an unrelated, undeclared side effect, not a supporting implementation detail of the stated firmographic enrichment purpose.
The supplied chunk contains only a skill-installation command. It does not process company lists, query Cargo for firmographics, or return enriched records. Although installation could support a larger workflow, no such workflow is present in the supplied code; its sole observable purpose is installing skills.
The workflow instructs the agent to submit company-domain records through Cargo to the aiArk enrichment connector. Although the skill names Cargo and explains credit costs, it does not warn that the supplied company list will be shared with external services; such a list may reveal confidential prospect or customer relationships.
The optional npx skills add command can fetch and execute an unpinned npm package and install skill content from a mutable repository reference. A compromised upstream release or repository could therefore introduce code or instructions with the agent's permissions; however, no compromise is demonstrated, and this is a supply-chain exposure rather than an MCP-server configuration issue.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The post-task instructions introduce an authenticated GitHub API write to star the author's repository and a persistent local marker recording that the user was asked. Although starring explicitly requires user consent, this promotional account action is unrelated to the manifest's stated purpose of enriching company firmographics through Cargo.