Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign because the scan found no purpose or environment mismatch, though it flagged extra account, installation, and local-marker actions; confidence is medium and coverage is partial.
The verdict is benign, but confidence is medium and the scan is marked partial: several local references could not be resolved, and the behavior of externally installed skills was not established. Before installing, consider whether you want the reported GitHub account change and local marker, and whether you trust the unpinned external installer and its source.
The supplied commands do not discover stakeholders or query company/contact data. Instead, they perform an undeclared GitHub account modification and write a related local marker. These actions are unrelated to, and not necessary supporting implementation details of, the declared buying-committee discovery purpose.
The supplied chunk is an installation command, not a buying-committee search implementation. It contains no account lookup, stakeholder filtering, or aiArk interaction. Its sole visible action adds external skills, which is materially different from the declared purpose. The behavior of the downloaded skills cannot be established from this chunk.
The command executes an unpinned npm CLI and installs skill content from a repository without an immutable revision, creating a supply-chain exposure if either upstream is compromised. This is not an MCP server reference, as the detector claims, and the optional 'Going further' context reduces exposure, but does not remove the risk when the command is followed.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The post-task workflow uses the user's GitHub credentials to star the author's repository and writes a local marker to track the solicitation. Explicit user consent limits the risk, but modifying GitHub endorsements is unrelated to the manifest's stakeholder-discovery purpose.