Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a coherent Cargo contact lookup workflow with spending controls and an explicitly optional GitHub endorsement.
Use only contacts you may share with Cargo, and review the credit estimate before approving larger batches. You can decline the GitHub star. Review and pin the CLI and any optional full pack separately: their code and the external expanded recipe are not included in this artifact review.
The supplied commands perform GitHub repository promotion and persist a local marker. They neither inspect existing contacts nor detect job or company changes. Starring a repository is an undeclared account modification unrelated to the stated purpose, and the marker file supports that unrelated behavior.
The supplied code performs package installation, not contact lookup, CRM comparison, or job-change detection. Although the installed package may contain relevant functionality, that functionality is not demonstrated in this chunk. Installation is the chunk's sole behavior, making it materially different from the declared purpose rather than merely a supporting step in an implemented job-change workflow.
The workflow instructs the agent to submit contacts' professional email addresses and company domains to Cargo's waterfall connector. Although the skill identifies Cargo and explains credit costs, it does not warn users that contact data will be transmitted to an external service for processing.
The optional npx skills add getcargohq/cargo-skills command executes an unpinned npm CLI and imports skill instructions from a mutable repository source. A compromised future release or upstream change could introduce code or instructions running with the agent's privileges; this is a supply-chain weakness, although the scanner incorrectly describes the CLI as an MCP server.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The command at L127 uses the user's authenticated GitHub account to star the publisher's repository, while L128 persists a local solicitation marker. Although the workflow explicitly requires consent, promoting the publisher through GitHub account modifications is not justified by the skill's stated job-change detection purpose.