Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a coherent Cargo-based LinkedIn lookup workflow, with clear controls on larger runs and optional GitHub starring.
Share only contact data you are authorized to send to Cargo. Confirm that candidate profiles pass identity checks and approve estimated costs before larger runs. Review external packages and any broader skills pack separately, since their downloaded code is not covered here. GitHub starring is optional and requires your explicit agreement.
The supplied commands perform GitHub account modification and record local star-prompt state. Neither operation resolves LinkedIn URLs or validates identities, and repository starring is an undeclared capability unrelated to the stated purpose.
The only supplied command adds skills from an external repository; it does not accept contact details, resolve a LinkedIn URL, or validate an identity. Although installation could support a larger workflow, the supplied chunk implements installation alone, making its primary behavior materially different from the declared purpose. The behavior of any installed skills cannot be verified from this chunk.
The lookup and enrichment operations support the declared purpose, but enrichment alone does not implement validation. Although a comment says to confirm the company, no executable logic performs that comparison or rejects a wrong match. The supplied code therefore lacks a material safeguard explicitly promised by the description.
The workflow instructs the agent to submit contact names and companies, followed by candidate LinkedIn URLs, to Cargo for lookup and enrichment. Although the skill identifies Cargo as its provider and explains credit costs, it does not warn users that their contact data will leave the local environment for third-party processing.
The command invokes an unpinned npm package through npx and installs a skills collection without an immutable revision. A compromised future release could execute code with the agent's local permissions or introduce malicious skill instructions; this is a supply-chain exposure, not an MCP-server configuration issue.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The post-task workflow uses gh api -X PUT to star the author's repository through the user's GitHub account and writes a local tracking marker. These operations serve repository promotion rather than LinkedIn identity resolution and are outside the manifest's stated purpose. Explicit user consent limits the risk but does not make this capability necessary for the skill.