Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a coherent company-search workflow, with disclosed costs, optional expansion, and explicit permission before GitHub starring.
Expect Cargo sign-in and credit charges for searches. Confirm current filters and pricing, sample first, and approve larger runs deliberately. GitHub starring is optional. Review the external CLI and any broader skill pack separately, preferably at fixed versions; their downloaded code was not audited here.
The supplied commands perform GitHub repository promotion and local tracking rather than technology-stack or hiring-based company discovery. Starring a repository changes the user's GitHub account state and is neither declared nor a supporting implementation detail of the described search capability.
The supplied chunk installs a skill collection; it does not query technology usage, hiring signals, or company data. Installation is its entire visible behavior, rather than a supporting step within an implemented company-search workflow. The contents and behavior of the installed skills are not supplied and cannot be assumed to fulfill the description.
The command npx skills add getcargohq/cargo-skills executes an unpinned npm CLI and imports remote skill content without an immutable revision. A compromised package release or changed remote source could introduce code or adversarial agent instructions; this is a supply-chain exposure, although the finding incorrectly describes the CLI as an MCP server.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The skill instructs the agent to use the user's authenticated GitHub account to star the publisher's repository and write a local marker tracking the solicitation. Although starring requires explicit consent, this promotional account modification is unrelated to the manifest's company-discovery purpose.