Security audit
Security checks for vulnerabilities and agentic risk
The skill provides the advertised contact enrichment workflow, with spending controls and explicit consent before any GitHub endorsement.
Use only contact URLs you are authorized to share with Cargo and aiArk, and check the sample cost before approving a larger batch. Review or pin the CLI and any additional skill pack before installation; those external components are outside this artifact review. You can decline the optional GitHub star.
The supplied code performs an unrelated GitHub account action and records local state. It does not process a LinkedIn URL, retrieve person-profile information, or verify a work email. Starring a repository is an undeclared capability, not a supporting implementation detail of contact enrichment.
The supplied code is a skill-installation command, not an enrichment implementation. It neither accepts a LinkedIn URL nor retrieves profile details or verifies an email address. Although installing skills could support a larger workflow, this chunk only performs installation; any downstream enrichment behavior is not shown and cannot be verified.
The workflow instructs the agent to submit LinkedIn profile URLs through Cargo to the aiArk enrichment provider. Although the services are named, the skill does not explicitly warn users that their supplied profile URLs, potentially including an entire contact list, will be shared with those third parties.
The command invokes an unpinned npm package through npx and installs skills from a repository without selecting an immutable revision. If the package or repository is compromised, a future invocation could execute malicious installation code or introduce adversarial agent instructions; however, this is an optional expansion step, not an MCP server configuration as the finding suggests.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The gh api -X PUT command stars the publisher's repository using the user's authenticated GitHub account, and the following command persists a local solicitation marker. Although the instructions require explicit consent before starring, repository promotion is unrelated to enriching LinkedIn profiles and is not part of the manifest's stated purpose.