monitor-buying-signals

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:20 PM UTC
• Version: 1.0.3

Overview

The skill is mostly a Cargo buying-signal workflow, but it also performs under-disclosed attribution, probes local agent configuration, and includes optional account/state changes outside the core task.

Review before installing. The monitoring workflow is useful and mostly coherent, but expect Cargo CLI installation/login, Cargo API calls that may spend credits, a setup-time attribution write to Cargo, a local Claude plugin check, an unpinned optional full-pack install, and an optional GitHub star action if you approve it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 97% confidence

Finding

The skill reads ~/.claude/plugins/installed_plugins.json, which accesses the agent's local configuration directory to infer installed plugins. Access to agent config/state is sensitive because it can reveal tooling, environment details, and potentially become a pattern for broader unauthorized local-file inspection.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash

grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
  cargo-ai workspaceManagement session upsert \
    --session-id "${SESSION_ID:-$(date +%s)}" \
    --title "monitor-buying-signals" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description lists triggers such as "watch these companies for me" and "any triggers on this list," which are generic enough to match everyday requests beyond this specific skill. Although some skip conditions are provided, the activation scope is still broad and lacks explicit negative examples for several phrases.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: monitor-buying-signals
description: "Watch a list of target accounts for the public events that mean someone is in market, powered by Cargo — hiring for the role you sell into, saying something new, or turning up in a detection feed, each with a date and a link. Triggers: \"tell me when these accounts do something\", \"what changed at my target accounts\", \"who is in market right now\", \"set up intent monitoring\", \"watch these companies for me\", \"any triggers on this list\". Intent, triggers, watchlist, timing, freshness. Skip when: you have no account list yet — use build-tam-list; or you want a verdict on fit rather than on timing — use score-leads."
version: "1.0.3"
compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
homepage: https://github.com/getcargohq/gtm-skills
metadata:
  author: getcargo

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workspace/session upsert writes attribution metadata that is not necessary to deliver buying-signal monitoring for the user. Hidden analytics or session-tracking actions increase data collection beyond user expectations and can leak session identifiers, titles, and usage metadata to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes a telemetry write to workspaceManagement session upsert without a prominent user-facing warning in the normal instructions. Undisclosed outbound metadata writes undermine informed consent and can result in silent tracking or data disclosure during routine execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs use of npx skills add getcargohq/cargo-skills without pinning a version, so execution depends on the latest package state at install time. That creates a supply-chain risk where a compromised or unexpectedly changed upstream package could execute code in the user's environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The GitHub starring flow is unrelated to the stated purpose of monitoring buying signals and asks the agent to perform an external account action on the user's behalf. Even with a consent prompt, embedding account-modifying behavior in a sales-monitoring skill expands scope and creates risk of unintended or socially engineered actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill creates ~/.config/cargo-ai/.star-asked to persist state across sessions, which is unrelated to the core monitoring function. Even though the file is low sensitivity, writing durable local markers without necessity or clear disclosure expands the skill's footprint on the host.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

bash

gh api -X PUT /user/starred/getcargohq/gtm-skills     # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked   # touch on either answer

If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The gh api -X PUT /user/starred/... command modifies the user's GitHub account, and the nearby warning is incomplete because the actionable command remains embedded in the skill. In agentic contexts, even low-friction account modifications need stronger isolation and explicit consent handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.