Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `node --import tsx evals/contract.mjs` from this skill's folder against the adapted resources
Security audit
tam-building
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Cargo TAM-building skill with disclosed paid data-sourcing steps and approval gates, not hidden or destructive behavior.
Before installing, confirm you trust the current Cargo CLI and cargo-cdk dependency versions, review the CDK plan before deploy, verify live connector prices, and make sure you are allowed to use website, customer-story, and LinkedIn company data for ICP/TAM building. Do not approve sourcing until the filter, limit, and maximum spend are clear.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (35)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `node --import tsx evals/contract.mjs` from this skill's folder against the adapted resources
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `node --import tsx evals/contract.mjs` from this skill's folder against the adapted resources
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README explicitly instructs the skill to read a website, customer stories, and enrich customers' LinkedIn pages to draft an ICP, but it provides no privacy, consent, data-minimization, or lawful-basis guidance. That can lead operators or downstream agents to collect and process third-party personal or profile data without clear authorization, creating privacy, compliance, and reputational risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill instructs use of
npx skills add ...without pinning a specific package version, which allows execution of whatever version is current at install time. That creates supply-chain risk: a compromised or breaking upstream release could run arbitrary install-time code or alter agent behavior when the skill is added.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx skills add getcargohq/cargo-skills --skill cargo-cdk
text Then read `.agents/skills/cargo-cdk/SKILL.md` directly; no session reload is needed. Complete its bootstrap and use its authoring, state, plan, and deployment rules throughout. Stop before any research or template work if the skill cannot be installed or read.
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md **Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked _asked_ genuinely live in the operator's head. | Input | Kind | How it is answered | Why it matters | | ----------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `icp` | derived | Read the workspace context repository first (`cargo-ai context …`, or the project's defineContext directory) for an ICP or scoring file. None? Offer to research the website, customer stories and customers' LinkedIn pages, then have it corrected | It is the one thing that cannot be computed. Everything else here is arithmetic on top of it | | `market_minimum` | derived | Industries, company size and countries, each guessed from `icp.md` with the line quoted. A criterion the file does not state is suggested from the research and marked as such, or asked. The operator confirms all three before any filter is built | These three are the floor of any TAM. Missing one sources a market with no edge in that dimension: every industry, every size, or the whole world, billed per record |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md **Derive before you ask.** An input with a lookup is looked up, not asked. Only the ones marked _asked_ genuinely live in the operator's head. | Input | Kind | How it is answered | Why it matters | | ----------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `icp` | derived | Read the workspace context repository first (`cargo-ai context …`, or the project's defineContext directory) for an ICP or scoring file. None? Offer to research the website, customer stories and customers' LinkedIn pages, then have it corrected | It is the one thing that cannot be computed. Everything else here is arithmetic on top of it | | `market_minimum` | derived | Industries, company size and countries, each guessed from `icp.md` with the line quoted. A criterion the file does not state is suggested from the research and marked as such, or asked. The operator confirms all three before any filter is built | These three are the floor of any TAM. Missing one sources a market with no edge in that dimension: every industry, every size, or the whole world, billed per record |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | `icp` | derived | Read the workspace context repository first (`cargo-ai context …`, or the project's defineContext directory) for an ICP or scoring file. None? Offer to research the website, customer stories and customers' LinkedIn pages, then have it corrected | It is the one thing that cannot be computed. Everything else here is arithmetic on top of it | | `market_minimum` | derived | Industries, company size and countries, each guessed from `icp.md` with the line quoted. A criterion the file does not state is suggested from the research and marked as such, or asked. The operator confirms all three before any filter is built | These three are the floor of any TAM. Missing one sources a market with no edge in that dimension: every industry, every size, or the whole world, billed per record | | `sourcing_filter` | derived | Translate the ICP into AI Ark filter groups (`industry`, `employeeSize`, `companyLocation`, then `companyType`, `employeeRole`, `technologies`, `funding`, …), resolving enum-backed values through `listIndustries` and its siblings | A flat map is ignored silently and a guessed enum member matches nothing. Either way you source a market nobody described | | `pool_size` | derived | `aiArk.countCompanies` with the same filter groups, in the JSON `--action` form in references/configure.md. It is free and returns `{"count": N}` | It is the only number that turns "is this filter right" into a question with an answer, and it costs nothing to ask | | `limit` | derived | Defaults to a fraction of the counted pool for the first run; widen once the report reads right. Ask only to change it. A capped run is not a random sample: AI Ark returned the largest ...[truncated 25 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md The code is a worked example. These reshapes are expected, and the agent offers them rather than waiting to be asked. Every one costs something; that is what makes it a variation and not the default. | Variation | When it is right | How | What it costs | | -------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `lookalike-sourcing` | The research found named customers that describe the market better than any facet does | Add `lookalikeDomains` (up to five customer domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`) | The pool is shaped by the seeds rather than by `icp.md`, so the two drift, and `countCompanies` becomes the only way to see what you asked for ...[truncated 25 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md The code is a worked example. These reshapes are expected, and the agent offers them rather than waiting to be asked. Every one costs something; that is what makes it a variation and not the default. | Variation | When it is right | How | What it costs | | -------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `lookalike-sourcing` | The research found named customers that describe the market better than any facet does | Add `lookalikeDomains` (up to five customer domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`) | The pool is shaped by the seeds rather than by `icp.md`, so the two drift, and `countCompanies` becomes the only way to see what you asked for ...[truncated 25 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md The code is a worked example. These reshapes are expected, and the agent offers them rather than waiting to be asked. Every one costs something; that is what makes it a variation and not the default. | Variation | When it is right | How | What it costs | | -------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `lookalike-sourcing` | The research found named customers that describe the market better than any facet does | Add `lookalikeDomains` (up to five customer domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`) | The pool is shaped by the seeds rather than by `icp.md`, so the two drift, and `countCompanies` becomes the only way to see what you asked for ...[truncated 25 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | Variation | When it is right | How | What it costs | | -------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `lookalike-sourcing` | The research found named customers that describe the market better than any facet does | Add `lookalikeDomains` (up to five customer domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`) | The pool is shaped by the seeds rather than by `icp.md`, so the two drift, and `countCompanies` becomes the only way to see what you asked for | | `refresh- ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | -------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `lookalike-sourcing` | The research found named customers that describe the market better than any facet does | Add `lookalikeDomains` (up to five customer domains or LinkedIn URLs) to the model config beside the filter groups (`infra/models/tam-companies.ts`) | The pool is shaped by the seeds rather than by `icp.md`, so the two drift, and `countCompanies` becomes the only way to see what you asked for | | `refresh-cadence` | The market moves and a one-time source goes stale | Give `tam_companies` a cron and widen `limit`, then read the deleting-a-schedule warning in that file before you ever remove it again | Every run re-bills every returned record, including the rows already there: a monthly refresh buys the handful of new companies at the price of the whole pool. On a free source (FullEnrich) a re-run costs no credits, and the contract allows the schedule; on a paid one, record the decision and edit the contract check in the same change | | `swap-sou ...[truncated 25 chars]
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The ICP hard-codes an English-language operating requirement as part of the sourcing criteria, which can systematically exclude otherwise valid companies based on language or region rather than product fit. In a TAM-building skill, this is especially impactful because the biased filter propagates into downstream sourcing, scoring, and routing, making the exclusion persistent across multiple workflows.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md Three sources, in this order, each feeding the next: | Source | What to read | Action | | ----------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | | The company's website | Homepage, product and pricing pages: who they say the product is for, and which problems they name | `parallel.extract` on the URLs, with that objective | | Customer stories | The customers page and case studies: named customers, and what each bought the product to fix | `parallel.extract` on the case-study URLs |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md `fetchCompanies` and `countCompanies` take the same shape: **nested groups**, each one config key holding suffixed sub-keys. | Group | What it constrains | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | Group | What it constrains | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed | | `employeeSize` | `min_employee_count`, `max_employee_count`, numbers | | `companyType` | `company_type_or`, for example privately held or public |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | Group | What it constrains | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed | | `employeeSize` | `min_employee_count`, `max_employee_count`, numbers | | `companyType` | `company_type_or`, for example privately held or public |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | Group | What it constrains | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed | | `employeeSize` | `min_employee_count`, `max_employee_count`, numbers | | `companyType` | `company_type_or`, for example privately held or public | | `employeeRole` | `employee_title_or`, the persona the company already employs |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed | | `employeeSize` | `min_employee_count`, `max_employee_count`, numbers | | `companyType` | `company_type_or`, for example privately held or public | | `employeeRole` | `employee_title_or`, the persona the company already employs | | `technologies` | the stack a company runs |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed | | `employeeSize` | `min_employee_count`, `max_employee_count`, numbers | | `companyType` | `company_type_or`, for example privately held or public | | `employeeRole` | `employee_title_or`, the persona the company already employs | | `technologies` | the stack a company runs |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | `companyInfo` | `domain_or`, `name_or`, `linkedin_url_or` | | `industry` | `industry_or` / `industry_not`, enum-backed | | `employeeSize` | `min_employee_count`, `max_employee_count`, numbers | | `companyType` | `company_type_or`, for example privately held or public | | `employeeRole` | `employee_title_or`, the persona the company already employs | | `technologies` | the stack a company runs |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | `companyType` | `company_type_or`, for example privately held or public | | `employeeRole` | `employee_title_or`, the persona the company already employs | | `technologies` | the stack a company runs | | `funding` | `funding_type` (enum-backed), `min_total_funding`, `max_total_funding` | | `companyLocation`, `companyKeywords`, `productAndServices`, `naics`, `annualRevenue`, `foundedYear`, `locationCount`, `headcountGrowth`, `employeeByDepartment`, `operationLanguage`, `companySocialMedia` | the rest of the surface | Conventions inside a group:
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md of this cookbook, and each brings its own dependencies. Recommend one, based on what the workspace already has, and let the operator pick. | Opening | What the operator gets | What it adds | | ------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **CRM coverage analysis** | How much of the TAM the CRM already holds, and the net-new list: "your CRM has 60% of your market" | A CRM companies extract (`crm-enrichment` ships one as `crm_accounts`) unified with `tam_companies` into the workspace's unified `accounts` model, which matches on domain and LinkedIn by default. Each unified account's `ids` column then shows whether a CRM record sits behind it. Read the unified model's merge settings; do not change them | | **Enrichment** | The fields AI Ark did not return, filled | `crm-enrichment` once the accounts are in the CRM; `enrich-company-data` for a one-off pass before that ...[truncated 24 chars]