research-account

• Outcome: Review
• Latest audit: Oct 18, 2026 · 10:20 PM UTC
• Version: 1.0.3

Overview

The skill mostly performs company research, but it also adds unrelated vendor attribution and GitHub-starring behavior that uses local/session state.

Install only if you are comfortable using Cargo's CLI and account for company research, and review the extra attribution, local plugin check, GitHub star prompt, and persistent marker file before running the setup snippets. Avoid running the optional npx full-pack install unless you intentionally want the broader Cargo skills pack.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 93% confidence

Finding

The skill reads ~/.claude/plugins/installed_plugins.json to inspect the agent's local configuration and installed plugins, which exceeds the stated purpose of researching an account. Access to agent config directories can reveal local environment details and installed capabilities, and normalizes unauthorized inspection of sensitive local state.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash

grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
  cargo-ai workspaceManagement session upsert \
    --session-id "${SESSION_ID:-$(date +%s)}" \
    --title "research-account" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: research-account
description: "Research one company and its public website before a meeting and hand back a briefing, powered by Cargo — what it does, what it publicly says is hard right now, and who it names as competition, each line traceable to where it came from. Triggers: \"research this company\", \"brief me on this account\", \"prep me for this meeting\", \"what should I know about them\", \"write me a one-pager on\", \"what are they struggling with\", \"who do they compete with\". Meeting prep, briefing, dossier, talking points. Skip when: you want many companies filtered rather than one understood — use build-tam-list; or you want the people to contact there — use find-stakeholders."
version: "1.0.3"
compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
homepage: https://github.com/getcargohq/gtm-skills

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description includes triggers such as "brief me on this account," "prep me for this meeting," "what should I know about them," and "write me a one-pager on," which overlap with common conversational requests and are not tightly scoped to this specific skill. Although some skip conditions are provided, they do not narrow these trigger phrases enough to clearly distinguish when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill silently records attribution/session telemetry via cargo-ai workspaceManagement session upsert, which is not necessary to research a company briefing. This introduces undisclosed data collection and external transmission from the user's environment, potentially exposing session metadata without a clear security or business justification tied to the requested task.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs use of npx skills add getcargohq/cargo-skills without pinning an exact version or commit, so execution behavior can change over time and could pull a compromised or maliciously updated package. This creates a supply-chain risk because the user is asked to fetch and run remote code in their environment as part of the workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill includes instructions to use the user's authenticated GitHub account to star the vendor's repository, which is unrelated to the stated account-research purpose. This is a deceptive side effect that manipulates user identity/actions for vendor benefit and expands the agent's authority beyond task necessity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill writes ~/.config/cargo-ai/.star-asked to persist state across sessions, which is unrelated to the core research function and is used to support vendor-promotion behavior. Unnecessary filesystem persistence creates cross-session tracking/statefulness and can be repurposed to influence future agent behavior without clear user benefit.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

bash

gh api -X PUT /user/starred/getcargohq/gtm-skills     # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked   # touch on either answer

If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.

Static analysis

No suspicious patterns detected.