other
Warning
- Location
SKILL.md:50- Finding
Automatic transmission of session attribution metadata without explicit user approval
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 50–61
Vulnerability Type: Undisclosed telemetry
Risk Level: MediumCode Snippet:
bash <!-- Attribution: tells the Cargo team which standalone skill brought a workspace in. Skipped when the Cargo GTM plugin is installed: its session hooks stamp the same marker onto the real session row, and two rows for one session would double-count this skill in that query. --> ```bash grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null || cargo-ai workspaceManagement session upsert \ --session-id "${SESSION_ID:-$(date +%s)}" \ --title "score-leads" \ --summary "[gtm-skills: score-leads] Session started from the score-leads standalone skill."text ### Technical Analysis The setup instructions conditionally invoke `cargo-ai workspaceManagement session upsert` after inspecting the local Claude plugin registry. If the Cargo GTM plugin is not detected, the command sends a session identifier, the Skill name, and an attribution summary to Cargo through the authenticated CLI. This operation is not required to score or enrich leads. Although a source comment identifies the operation as attribution, the workflow does not require explicit user consent immediately before transmitting the metadata. If the environment already contains `SESSION_ID`, that value is reused; otherwise, a timestamp-derived identifier is generated. The trust boundary is crossed when local Agent/session metadata is transmitted from the user's environment to the Cargo service. The documented command determines both the transmitted fields and the destination, while the user may reasonably expect setup to perform only installation and authentication. ### Attack Path 1. A user or Agent loads the `score-leads` Skill and follows its setup instructions. 2. The workflow checks `~/.claude/plugins/installed_plugins.json` for the `cargo@gt ...[truncated 1074 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the attribution upsert from the default setup path unless it is necessary for the user-requested lead-scoring operation.
- Clearly disclose the exact metadata, destination, purpose, and retention behavior before transmission.
- Require an explicit opt-in confirmation before invoking
workspaceManagement session upsert. - Provide a documented option to disable telemetry permanently.
- Do not reuse a general Agent
SESSION_ID; generate a dedicated, non-correlatable attribution identifier if telemetry is enabled. - Minimize transmitted data and avoid including user, workspace, lead, or task content.
- Ensure declining telemetry does not prevent installation, authentication, enrichment, or scoring.