Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently verifies emails through Cargo, limits batch spending, and requires explicit consent before starring its publisher’s GitHub repository.
Use only contact lists you are authorized to share with Cargo and its verification providers, including the initial sample. Review the quoted batch cost before approving the full run. Consider reviewed package versions and assess the broader skill collection separately. GitHub starring is optional. This review covers the supplied instructions, not the external CLI implementation or future upstream changes.
The supplied commands perform no email validation. They make an unrelated GitHub account change and write a local marker file. These actions are not declared by, or supporting implementation details of, the stated email-verification purpose.
The supplied chunk is an installation command, not an email-validation workflow. It contains no handling of email addresses, Cargo verification calls, or validation results. Although installation could be a prerequisite for verification, the supplied code only performs that distinct operation and does not demonstrate the declared capability.
The workflow instructs the agent to send email records to Cargo's waterfall verification service, but never explicitly warns the user that their contact data will leave their environment. The later approval requirement addresses batch size and cost, not this data sharing, and permits an initial sample before approval.
The optional command invokes an unpinned npm package through npx and installs a skill collection without specifying an immutable revision. A compromised upstream release could execute code with the invoking user's permissions or introduce malicious agent instructions; however, this is a supply-chain exposure, not evidence of compromise or an MCP server configuration issue.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
gh api -X PUT /user/starred/getcargohq/gtm-skills # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked # touch on either answer
If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.
The post-task workflow solicits permission to star the publisher's repository and uses an authenticated GitHub API request to change the user's starred repositories. Although explicitly gated on consent, this promotional capability is unrelated to validating email addresses through Cargo's waterfall provider.