Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly describes its extraction workflow, costs, and approval requirements, with no evidence of hidden harmful behavior.
Review the extraction estimate before approving a full run; repeated people extractions consume additional credits. Personal Sales Navigator access and GitHub starring are optional and require your explicit agreement. The external CLI and optional skills bundle were not included for inspection, so review their versions and contents separately.
The supplied code performs a GitHub account modification and records a local marker; it does not count, split, merge, or extract Sales Navigator searches. Starring a GitHub repository is an undeclared capability unrelated to the described extraction workflow, not a supporting implementation detail.
The supplied code's sole operation is skill installation, which is materially different from the described extraction workflow. Installation could be a prerequisite, but the chunk does not implement or invoke the declared workflow. The behavior of any downloaded or installed code cannot be established from this snippet.
The optional command executes an unpinned npm package through npx and installs skill content from a repository without specifying an immutable revision. Although this is not an MCP server reference, it introduces a supply-chain risk: a compromised or malicious future release could execute code with the user's permissions or introduce adversarial agent instructions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
L300 uses the user's authenticated GitHub account to star the publisher's repository, and L301 writes a local marker to track whether the promotional request was made. Neither operation supports counting, splitting, merging, or extracting Sales Navigator searches. The explicit-consent requirement mitigates the risk of unauthorized endorsement but does not make this capability necessary for the skill's stated purpose.