tam-building

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:54 AM UTC
• Version: 0.3.0

Overview

The skill is a coherent Cargo TAM sourcing and tiering workflow that discloses its paid connector use, context reads, web search, and row writes with approval gates before deployment and sourcing.

Before installing, review and preferably pin the Cargo CLI and cargo-cdk dependency, replace the placeholder ICP and rubric with your own reviewed content, keep secrets out of workspace context markdown, and verify the plan and cost estimates before approving any sourcing run.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The description presents a broader end-to-end TAM/account-universe pipeline: search companies via AI Ark, estimate size before billing, fetch companies, and then tier them. The supplied code chunk only implements the tiering play over an existing tamCompanies model. It filters untiered or stale rows, invokes a tiering agent, and persists the results. This is not merely an implementation detail omission; the primary declared purpose emphasizes sourcing and pipeline construction, while the actual code is limited to scoring/tiering already sourced companies. The code does align with the agent-based rubric-driven tiering part of the description, but significant declared capabilities are absent from this chunk.

Ae1

High

• Category: analysis-evasion

Content

`node --import tsx evals/contract.mjs` against the adapted resources before the plan is reviewed.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

`node --import tsx evals/contract.mjs` against the adapted resources before the plan is reviewed.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

`node --import tsx evals/contract.mjs` against the adapted resources before the plan is reviewed.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill instructs use of `npx skills add ...` and `@latest`, which causes execution of whatever package version is current at install time rather than a reviewed, pinned version. In a supply-chain compromise or malicious package update, an operator could execute attacker-controlled code during install/bootstrap with the privileges of their workstation or CI environment.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

npx skills add getcargohq/cargo-skills --skill cargo-cdk
```

Then read `.agents/skills/cargo-cdk/SKILL.md` directly; no session reload is needed. Complete its
bootstrap and use its authoring, state, plan, and deployment rules throughout. Stop before any
sizing or template work if the skill cannot be installed or read.

• Confidence: 80% confidence
• Finding: The skill directs the operator to install another skill and then read and follow `.agents/skills/cargo-cdk/SKILL.md` directly, effectively delegating behavior to additional unreviewed local content. This expands the trust boundary and can be abused for prompt/instruction injection, causing the agent or operator to execute unsafe steps from a secondary skill without the same scrutiny applied to the current file.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The skill tells operators to copy `infra/context/*.md` into the shared workspace context and to derive/write ICP and tiering rubric content there, but gives no warning about storing sensitive customer strategy, targeting criteria, or internal notes in a broadly accessible context layer. If that context is exposed to other agents, users, logs, or repositories, confidential business data may be unnecessarily propagated and later exfiltrated through prompts, search, or downstream integrations.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

**Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked
_asked_ genuinely live in the operator's head.

| Input             | Kind    | How it is answered                                                                                                                                                                                             | Why it matters                                                                                                                                                  |
| ----------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `icp`             | derived | Read the workspace context repository first (`cargo-ai context …`, or the project's defineContext directory). Ask only when no ICP is written down anywhere, and then write it to the project's context/icp.md | It is the one thing that cannot be computed: it encodes who you sell to. Everything else here is arithmetic or judgment on top of it                            |
| `sourcing_filter` | derived | Translate the ICP into AI Ark filter groups (`industry`, `employeeSize`, `companyType`, `employeeRole`, `technologies`, `funding`, …), resolving enum-backed values through `listIndustries` and its siblings  | A flat map is ignored silently and a guessed enum member matches nothing. Either way you source a market nobody described                                       |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `icp`             | derived | Read the workspace context repository first (`cargo-ai context …`, or the project's defineContext directory). Ask only when no ICP is written down anywhere, and then write it to the project's context/icp.md | It is the one thing that cannot be computed: it encodes who you sell to. Everything else here is arithmetic or judgment on top of it                            |
| `sourcing_filter` | derived | Translate the ICP into AI Ark filter groups (`industry`, `employeeSize`, `companyType`, `employeeRole`, `technologies`, `funding`, …), resolving enum-backed values through `listIndustries` and its siblings  | A flat map is ignored silently and a guessed enum member matches nothing. Either way you source a market nobody described                                       |
| `pool_size`       | derived | The JSON --action form in references/configure.md: aiArk.countCompanies with the same filter groups. It is free and returns {"count": N}                                                                       | It is the only number that turns "is this filter right" into a question with an answer, and it costs nothing to ask                                             |
| `limit`           | derived | Defaults to a fraction of the counted pool for the first run; widen once rows land correctly. Ask only to change it                                                                                            | `fetchCompanies` bills per returned record, so this is the invoice. Sourcing wide and filtering later means paying for every company the rubric will throw away |
| `tier_rubric`     | asked   | Propose A / B / C / disqualified from the ICP's own language, then have the operator correct it. It is written to the project's context/tiering-rubric.md, not into the agent prompt                           | It is what the whole book gets judged against, and the one thing the operator will want to change next month without a deploy                      
...[truncated 25 chars]

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `pool_size`       | derived | The JSON --action form in references/configure.md: aiArk.countCompanies with the same filter groups. It is free and returns {"count": N}                                                                       | It is the only number that turns "is this filter right" into a question with an answer, and it costs nothing to ask                                             |
| `limit`           | derived | Defaults to a fraction of the counted pool for the first run; widen once rows land correctly. Ask only to change it                                                                                            | `fetchCompanies` bills per returned record, so this is the invoice. Sourcing wide and filtering later means paying for every company the rubric will throw away |
| `tier_rubric`     | asked   | Propose A / B / C / disqualified from the ICP's own language, then have the operator correct it. It is written to the project's context/tiering-rubric.md, not into the agent prompt                           | It is what the whole book gets judged against, and the one thing the operator will want to change next month without a deploy                                   |
| `llm`             | derived | Inspect the authenticated LLM connectors and pick the one already in use, with its current model slug                                                                                                          | A second LLM connector is a collision at deploy, and a stale model slug fails at run time rather than at plan time                                              |

Checked before moving on, not after the deploy:

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

The code is a worked example. These reshapes are expected, and the agent offers them rather than
waiting to be asked. Every one costs something; that is what makes it a variation and not the default.

| Variation                    | When it is right                                                                                                 | How                                                                                                                                                                   | What it costs                                                                                                                                                                                        |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `lookalike-sourcing`         | Your best customers describe the ICP better than any facet does, which is usual before a segment is written down | Add `lookalikeDomains` (up to five domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`)                           | The pool is shaped by the seeds rather than by anything written down, so it drifts from `icp.md` and `countCompanies` becomes the only way to see what you asked for                                 |
| `refresh-cadence`            | The market moves and a one-time source goes stale                                                                | Give the model a cron and widen `limit` (`infra/models/tam-companies.ts`), then read the deleting-a-schedu
...[truncated 25 chars]

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

The code is a worked example. These reshapes are expected, and the agent offers them rather than
waiting to be asked. Every one costs something; that is what makes it a variation and not the default.

| Variation                    | When it is right                                                                                                 | How                                                                                                                                                                   | What it costs                                                                                                                                                                                        |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `lookalike-sourcing`         | Your best customers describe the ICP better than any facet does, which is usual before a segment is written down | Add `lookalikeDomains` (up to five domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`)                           | The pool is shaped by the seeds rather than by anything written down, so it drifts from `icp.md` and `countCompanies` becomes the only way to see what you asked for                                 |
| `refresh-cadence`            | The market moves and a one-time source goes stale                                                                | Give the model a cron and widen `limit` (`infra/models/tam-companies.ts`), then read the deleting-a-schedu
...[truncated 25 chars]

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

The code is a worked example. These reshapes are expected, and the agent offers them rather than
waiting to be asked. Every one costs something; that is what makes it a variation and not the default.

| Variation                    | When it is right                                                                                                 | How                                                                                                                                                                   | What it costs                                                                                                                                                                                        |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `lookalike-sourcing`         | Your best customers describe the ICP better than any facet does, which is usual before a segment is written down | Add `lookalikeDomains` (up to five domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`)                           | The pool is shaped by the seeds rather than by anything written down, so it drifts from `icp.md` and `countCompanies` becomes the only way to see what you asked for                                 |
| `refresh-cadence`            | The market moves and a one-time source goes stale                                                                | Give the model a cron and widen `limit` (`infra/models/tam-companies.ts`), then read the deleting-a-schedu
...[truncated 25 chars]

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The line states that the buying committee 'must operate in English,' which is a natural-language locale constraint. The file does not offer a language choice, opt-in, or a region-specific justification for this requirement, so it conflicts with the language/locale policy criteria.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Tiers

| Tier           | What it means                                   | The bar                                                                                                                                                   |
| -------------- | ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `A`            | Work it now                                     | Fits the firmographics AND shows at least one piece of evidence from "What 'already running the motion' looks like", ranked 1 or 2                        |
| `B`            | Worth a sequence, not a rep                     | Fits the firmographics AND shows evidence ranked 3 or 4, or fits everything but the persona is inferred rather than observed                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

Two files, and they do different jobs:

| File                | What it holds                                                                                | Who reads it                                             |
| ------------------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
| `icp.md`            | Who buys, the firmographics, the disqualifiers, what "already running the motion" looks like | The agent on every judgment; the operator when it drifts |
| `tiering-rubric.md` | What A, B, C and disqualified mean, and what evidence may decide each                        | The agent on every judgment; the rep reading a tier      |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

`fetchCompanies` and `countCompanies` take the same shape: **nested groups**,
each one config key holding suffixed sub-keys.

| Group                                                                                                                                                                                                      | What it constrains                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Group                                                                                                                                                                                                      | What it constrains                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Group                                                                                                                                                                                                      | What it constrains                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Group                                                                                                                                                                                                      | What it constrains                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |
| `employeeRole`                                                                                                                                                                                             | `employee_title_or`, the persona the company already employs           |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |
| `employeeRole`                                                                                                                                                                                             | `employee_title_or`, the persona the company already employs           |
| `technologies`                                                                                                                                                                                             | the stack a company runs                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |
| `employeeRole`                                                                                                                                                                                             | `employee_title_or`, the persona the company already employs           |
| `technologies`                                                                                                                                                                                             | the stack a company runs                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |
| `employeeRole`                                                                                                                                                                                             | `employee_title_or`, the persona the company already employs           |
| `technologies`                                                                                                                                                                                             | the stack a company runs                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `companyInfo`                                                                                                                                                                                              | `domain_or`, `name_or`, `linkedin_url_or`                              |
| `industry`                                                                                                                                                                                                 | `industry_or` / `industry_not`, enum-backed                            |
| `employeeSize`                                                                                                                                                                                             | `min_employee_count`, `max_employee_count`, numbers                    |
| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |
| `employeeRole`                                                                                                                                                                                             | `employee_title_or`, the persona the company already employs           |
| `technologies`                                                                                                                                                                                             | the stack a company runs                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| `companyType`                                                                                                                                                                                              | `company_type_or`, for example privately held or public                |
| `employeeRole`                                                                                                                                                                                             | `employee_title_or`, the persona the company already employs           |
| `technologies`                                                                                                                                                                                             | the stack a company runs                                               |
| `funding`                                                                                                                                                                                                  | `funding_type` (enum-backed), `min_total_funding`, `max_total_funding` |
| `companyLocation`, `companyKeywords`, `productAndServices`, `naics`, `annualRevenue`, `foundedYear`, `locationCount`, `headcountGrowth`, `employeeByDepartment`, `operationLanguage`, `companySocialMedia` | the rest of the surface                                                |

Conventions inside a group:

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: infra/context/icp.md:10